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ABSTRACT 


This  thesis  develops  an  Operator’s  Model  that  mimics  the  real-world  behavior  of  coal 
transport  in  the  Port  of  Pittsburgh  and  allows  for  systematic  investigation  of  “what  if’ 
disruption  scenarios.  We  model  the  multi-modal  flow  of  coal  using  a  network  of  nodes 
and  arcs  representing  river  transport,  with  support  from  a  surrounding  system  of  rail  lines 
and  roads.  Each  mode  of  shipment  has  finite  capacities  with  varying  costs.  Our  model 
routes  flows  in  order  to  satisfy  contracted  supplies  and  demands  at  minimum 
transportation  cost.  We  use  2009  coal  shipment  data  provided  by  the  United  States  Army 
Corps  of  Engineers  to  drive  delivery  patterns.  We  focus  our  attention  on  the 
Monongahela  River,  which  carries  a  significant  amount  of  coal  through  our  system.  We 
employ  Defender-Attacker-Defender  techniques  to  assess  critical  infrastructure  in  the 
context  of  an  intelligent  adversary,  such  as  a  terrorist,  who  seeks  to  damage  the  system  so 
as  to  maximally  increase  its  operating  cost.  This  allows  us  to  assess  the  relative 
importance  of  critical  system  components  in  order  to  help  the  United  Stated  Coast  Guard 
identify  where  to  focus  their  attention. 
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EXECUTIVE  SUMMARY 


The  United  States  (U.S.)  economy  is  dependent  upon  coal  to  produce  low  cost  energy  and 
to  manufacture  steel.  The  Three  Rivers  region  of  Pittsburgh,  Pennsylvania — consisting  of 
the  Ohio  River,  the  Allegheny  River,  and  the  Monongahela  River — sits  on  one  of  the 
richest  coal  reserves  in  the  U.S..  The  Port  of  Pittsburgh  stretches  over  more  than 
300  miles  of  river  and  supports  an  extensive  coal  mining  and  coal  consuming  industry. 
Nearly  $9  billion  of  commerce  flows  through  this  river  system  annually,  making  it  the 
second  largest  inland  port  in  the  U.S.  and  a  valuable  target  for  terrorist  attack.  The  United 
States  Coast  Guard  (USCG)  is  responsible  for  safe,  uninterrupted  transport  (and 
coordinated  security)  along  these  inland  waterways,  and  this  port  is  of  particular 
importance  to  this  mission. 

Coal  is  delivered  from  mines  to  plants  primarily  via  the  river,  with  support  from  a 
surrounding  system  of  rail  lines  and  roads.  Transporting  coal  by  barge  on  river  is  the 
most  economical  and  efficient  means  of  delivery.  Rail  offers  a  more  costly  alternative, 
and  trucks  on  roads  are  the  most  expensive  method  of  transportation.  Loading  and 
offloading  coal  are  also  costly  processes.  But  these  costs  are  small  relative  to  the  huge 
financial  loses  and  catastrophic  facility  shutdowns  that  could  occur  if  coal  was  unable  to 
move  from  supplier  to  consumer  for  an  extended  period  of  time. 

The  primary  contribution  of  this  thesis  is  the  development  of  an  Operator’s  Model 
that  mimics  the  behavior  of  coal  transport  in  the  Port  of  Pittsburgh  and  allows  for 
systematic  investigation  of  “what  if’  scenarios.  We  model  the  multi-modal  flow  of  coal 
using  a  network  of  nodes  and  arcs.  Each  mode  of  shipment  has  finite  capacities  with 
varying  costs.  Our  model  routes  flows  in  order  to  satisfy  contracted  supplies  and  demands 
at  minimum  transportation  cost.  We  use  real-world  2009  data  provided  by  the  United 
States  Anny  Corps  of  Engineers  to  drive  delivery  patterns. 

We  employ  Defender- Attacker-Defender  techniques  to  assess  critical 
infrastructure  in  the  context  of  an  intelligent  adversary,  such  as  a  terrorist,  who  seeks  to 
damage  the  system  so  as  to  maximally  increase  its  operating  cost.  Key  assets  in  our 
system  include  dams,  which  segment  the  rivers  into  pools  and  maintain  water  levels  that 


xv 


enable  navigability;  locks,  which  allow  for  transit  between  these  pools;  bridges,  which 
connect  land  masses  by  crossing  over  rivers;  and  intermodal  transfer  equipment,  which 
loads  and  offloads  cargo  and  facilitates  transfer  between  rivers,  roads,  and  rails. 

We  focus  our  attention  on  the  Monongahela  River,  which  carries  a  significant 
amount  of  coal  through  our  system.  Our  model  first  analyzes  normal  operating 
conditions,  routing  coal  by  barge,  and  then  considers  the  effects  of  disruptions  to  the  river 
system.  We  identify  interdictions  that  result  in  worst-case  disruptions,  where  “worst- 
case”  means  the  highest  total  cost  even  after  the  system  has  rebalanced  flows.  The  model 
illustrates  rerouting  behaviors  and  impact  costs  associated  with  operating  in  this  damaged 
system.  This  helps  us  assess  the  relative  importance  of  critical  system  components  to  help 
the  USCG  to  identify  where  to  focus  its  attention. 

We  observe  that  a  single  attack  on  the  pool  connecting  the  Monongahela  River  to 
the  rest  of  the  Pittsburgh  Port  incurs  significant  cost  increases.  Attacking  the  dam 
supporting  this  pool  renders  the  pool  useless.  Subsequent  “next  best”  attacks  also  target 
other  dams  and  eventually  some  locks.  Each  disruption  to  the  river  unavoidably  increases 
traffic  on  other  modes  of  transport,  increasing  overall  cost. 

We  consider  two  alternative  scenarios.  First,  we  analyze  a  situation  in  which  we 
assume  that  the  USCG  can  perfectly  protect  the  dams  from  attack.  Defending  dams 
causes  the  attacker  to  target  locks  instead,  thereby  decreasing  the  worst-case  cost  of  an 
attack  on  an  unprotected  system.  The  second  scenario  is  a  situation  in  which  the  USCG 
can  perfectly  protect  both  dams  and  locks.  With  the  water  protected,  the  attacker  can  only 
target  land-based  tenninals,  rail  segments  and  road  segments.  However,  an  attacker  still 
has  the  ability  to  isolate  a  major  coal  supplier  from  the  network  by  interdicting  river,  rail, 
and  road  intermodal  transfer  arcs  connecting  the  supplier  to  the  rest  of  the  world.  Because 
our  model  highly  penalizes  such  infeasibilities,  the  cost  skyrockets,  as  the  coal  supplier  is 
unable  to  move  cargo  onto  the  system. 

Our  model  can  be  applied  to  others  ports  within  the  Inland  Waterway  System, 
however  doing  so  will  require  significant  effort  to  develop  the  appropriate  input  data  and 
exercise  various  what-if  scenarios  of  interest. 
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I.  INTRODUCTION 


The  United  States  relies  on  low-cost  transportation  of  goods.  Bulk  shipment  of 
commodities  is  vital  to  the  U.S.  economy  and  its  national  security.  A  complicated 
network  of  rivers,  rail  lines,  and  roads  enable  the  surface  movement  of  large  quantities  of 
raw  materials  across  the  country.  Despite  the  ubiquity  of  air  transport,  most  physical 
goods  move  by  ground,  as  their  value  per  unit  weight  does  not  justify  air  delivery 
(Research  and  Innovative  Technology  Administration  Bureau  of  Transportation  Statistics 
2002).  The  primary  commodity  transported  by  river  and  rail  in  the  U.S.  is  coal.  Coal  is  an 
industrial  and  residential  necessity,  providing  heat,  electricity,  and  a  means  to  produce 
steel.  A  disruption  to  this  network  could  inflict  costly  consequences,  as  frustrated 
shipments  attempt  to  find  new  delivery  routes. 

The  Three  Rivers  region  of  Pittsburgh,  Pennsylvania  sits  on  one  of  the  richest  coal 
reserves  in  the  U.S..  The  Monongahela  and  Allegheny  Rivers  converge  to  form  the  Ohio 
River  at  the  Point  of  Pittsburgh.  These  three  rivers  stretch  more  than  300  miles  and  define 
the  area  known  as  the  Port  of  Pittsburgh.  The  United  States  Army  Corps  of  Engineers 
(USAGE)  ranks  the  Port  of  Pittsburgh  as  the  second  busiest  inland  port  in  the  United 
States  (USAGE  2012).  The  Port  of  Pittsburgh  Commission  (PPC)  provides  extensive 
information  regarding  locks,  dams,  and  river  characteristics  (PPC  2012a).  The  Ohio  River 
connects  the  Port  of  Pittsburgh  to  the  rest  of  the  Inland  Waterways  System,  a  system  of 
more  than  25,000  miles  of  navigable  waters  in  the  Eastern  United  States  (Figure  1).  Coal 
and  other  commodities  are  transported  into  and  out  of  the  region  via  barge  on  this  river. 
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Figure  1.  The  Inland  Waterway  System.  Source:  PPC  2012b. 

The  Port  of  Pittsburgh  is  regulated  by  a  series  of  locks  and  dams  and  provides  the 
primary  means  of  coal  delivery  to  power  companies  and  steel  producers  in  the  area. 
Labor  disputes,  natural  disasters,  terrorist  attacks,  and  even  anticipated  maintenance  on 
the  existing  infrastructure  can  disrupt  the  function  of  this  system.  A  catastrophic 
disruption  to  the  coal-delivery  supply  chain  could  cause  national  consequences,  including 
a  rise  in  utility  costs  and  steel  prices.  The  Port  of  Pittsburgh  Commission  reports  that 
“inland  waterway  transportation  is  generally  the  least-costly  transportation  mode. 
Average  cost  ranges  between  $0,005  and  $0.01  per  ton-mile  of  cargo  moved.  This 
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compares  to  nearly  $0.05  for  rail  and  $0.10  for  truck”  (PPC  2012b).  Therefore, 
stakeholders  are  intent  on  providing  resilient  transportation  along  these  waterways  to 
maintain  low  costs. 

The  enormous  capacity  of  the  river  system  and  its  low  operating  costs  make  it  the 
primary  means  of  bulk  commodity  shipment  through  the  Port  of  Pittsburgh.  Although 
there  are  multiple  modes  of  transport  for  coal  in  this  region,  the  large  demand  volumes 
make  it  cost  prohibitive  to  supply  adequate  quantities  in  the  long  term  by  means  other 
than  river.  Figure  2  shows  cargo  capacity  of  different  modes  of  transport;  clearly  barges 
can  carry  much  more  cargo. 


Cargo  Capacity  Comparison 


ONE  JUMBO 
HOPPER  CAR 
(100  tons) 


4  LARGE 
SEMI  TRUCKS 
(25  tons  each) 


ONE  BARGE  (1.T50  TONS)  =  16  JUMBO  HOPPER  CARS 


ONE  BARGE  (1,750  TONS)  =  70  LARGE  SEMI  TRUCKS 


15  BARGE  TOW  =  216  RAILROAD  CARS  OR  1,050  TRUCKS 


•  Moving  cargo  by  waterway  transportation  Is  40%  more  efficient  than  railroads. 


Figure  2.  Comparison  of  cargo  capacity  of  rail  car,  truck,  and  barge.  Source:  Port  of 
Pittsburgh  Commission,  2012c. 
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In  practice,  the  most  cost  effective  means  for  moving  coal  on  the  river  is  via 
multiple  barges  pushed  by  a  single  towboat.  Figure  3  displays  a  “12-barge  tow.” 


Figure  3.  The  most  economical  way  to  move  coal  is  by  barge.  Source:  USACE  2012. 

The  interdiction  of  coal  delivery  along  these  primary  river-shipment  routes  would 
have  dire  implications.  For  purposes  of  this  thesis,  interdiction  is  the  interruption  of 
commodity  movement  through  our  system.  Limited  capacity  and  availability  of  rail  cars 
calls  into  question  the  viability  of  trains.  Additionally,  transporting  large  volumes  of  coal 
via  truck  could  place  an  extreme  burden  on  the  road  network,  causing  immediate 
bottlenecks.  Many  coal  consumers  maintain  some  level  of  reserves  on  hand  to  mitigate 
fluctuations  in  delivery  or  consumption  rates  and  for  emergency  situations.  However, 
these  reserves  are  finite,  and  steel  manufacturers  in  the  Pittsburgh  region  cannot  run  out 
of  coal  or  they  risk  huge  financial  loses  and  catastrophic  facility  shutdowns. 

The  vulnerability  of  aging  infrastructure  along  with  economic  significance  makes 
Pittsburgh  a  real  target.  Protecting  the  city  and  its  infrastructure  is  challenging — there  are 
three  modes  of  transportation  and  so  many  routes  into  the  city  that  protecting  them  all  is 
impossible.  Potential  attacks  include  blocking  traffic  through  locks,  destroying  dams, 
dropping  bridges  that  cross  the  rivers,  or  even  attacking  the  commodity-carrying  vessels. 
This  infrastructure  is  not  heavily  guarded  and  is  easily  accessible.  Protection  of  locks  and 
dams  from  the  shore  is  the  responsibility  of  local  municipalities,  and  defense  from  the 
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water  resides  with  the  United  States  Coast  Guard  (USCG).  Bridges  and  slow-moving 
vessels  (barges  travel  at  an  average  speed  of  approximately  4  miles  per  hour)  are  very 
accessible,  making  them  soft  targets.  Repairs  subsequent  to  an  attack  on  this  aging 
infrastructure  are  estimated  to  require  weeks  to  months,  depending  on  the  extent  of  the 
damage  and  the  components  damaged. 

The  USCG  is  tasked  with  ensuring  economic  stability  and  safe  navigation  of  these 
waterways.  One  of  the  missions  of  the  USCG  is  the  protection  of  Ports,  Waterways,  and 
Coastal  Security  (PWCS). 

PWCS  is  the  protection  of  the  U.S.  Maritime  Domain  and  the  U.S.  Marine 
Transportation  System  (MTS)  and  those  who  live,  work  or  recreate  near 
them;  the  prevention  and  disruption  of  terrorist  attacks,  sabotage, 
espionage,  or  subversive  acts;  and  response  to  and  recovery  from  those 
that  do  occur.  Conducting  PWCS  deters  terrorists  from  using  or  exploiting 
the  MTS  as  a  means  for  attacks  on  U.S.  territory,  population  centers, 
vessels,  critical  infrastructure,  and  key  resources.  PWCS  includes  the 
employment  of  awareness  activities;  counterterrorism,  antiterrorism, 
preparedness  and  response  operations;  and  the  establishment  and  oversight 
of  a  maritime  security  regime.  PWCS  also  includes  the  national  defense 
role  of  protecting  military  out-load  operations.  (USCG,  2011) 

In  Pittsburgh,  the  USCG  District  8  Command  has  jurisdiction  for  these  328  miles 
of  river,  which  connect  Pennsylvania,  Ohio,  and  West  Virginia.  Complicating  the  USCG 
mission  are  the  many  bridges,  projected  reductions  in  USCG  force  size,  and  increased 
concern  about  terrorist  attack  in  the  post- 9/1 1  era.  Traditional  security  is  only  part  of  the 
solution.  This  infrastructure  faces  not  only  deliberate  threats  from  terrorists  and 
saboteurs,  but  it  is  also  at  risk  to  disruptions  from  engineering  failures,  accidents,  and 
natural  disasters.  As  demand  for  coal  increases,  rising  shipping  traffic  and  strains  on 
infrastructure  will  result.  The  USCG  needs  to  be  able  to  identify  worst-case  disruptions  in 
advance  of  their  occurrence  and  no  matter  their  cause. 

The  solution  to  maintaining  economic  and  industrial  stability  in  the  event  of  an 
attack  is  the  development  of  a  resilient  system.  For  purposes  of  this  thesis,  we  define 
resilience  as  the  ability  of  a  system  to  maintain  its  function  in  the  presence  of  internal  or 
external  disruptions;  this  definition  is  consistent  with  that  of  the  Homeland  Security 
Advisory  Council  (HSAC  2006)  and  the  Homeland  Security  Council  (HSC  2007).  Ways 
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to  achieve  such  resiliency  include  increased  capacity  of  infrastructure,  improved 
protection  of  critical  components,  or  cost-effective  re-routing  plans  to  optimally  ship 
commodities  in  the  event  of  disruption.  The  U.S.  National  Strategy  for  Homeland 
Security  says,  “we  must  now  focus  on  the  resilience  of  the  system  as  a  whole — an 
approach  that  centers  on  investments  that  make  the  system  better  able  to  absorb  the 
impact  of  an  event  without  losing  the  capacity  to  function”  (HSC  2007). 

The  goal  of  this  thesis  is  to  assess  the  resiliency  of  the  system  of  rivers,  rails,  and 
roads  that  move  coal  from  mines  to  customers  in  the  Pittsburgh  area.  We  use  Defender- 
Attacker-Defender  (DAD)  techniques  to  identify  which  components  to  defend  and 
provide  minimum-cost  solutions  to  routing  in  the  event  of  failures  in  the  system.  By 
applying  these  methods  to  the  Port  of  Pittsburgh,  we  assess  the  relative  importance  of 
critical  system  components  in  order  to  help  the  USCG  identify  where  to  focus  its 
attention. 
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II.  LITERATURE  REVIEW 


This  thesis  contributes  to  the  body  of  existing  works  in  the  area  of  optimization, 
the  defense  of  critical  infrastructure,  and  the  transportation  of  commodities.  While  the 
following  related  works  are  not  exhaustive,  they  contain  underpinnings  vital  to  this  work. 

A.  CRITICAL  INFRASTRUCTURE  AND  RISK 

The  National  Infrastructure  Protection  Plan  (NIPP)  identifies  critical 
infrastructure  as,  “systems  and  assets,  whether  physical  or  virtual,  so  vital  to  the  United 
States  that  the  incapacity  or  destruction  of  such  systems  and  assets  would  have  a 
debilitating  impact  on  security,  the  national  economy,  national  public  health  or  safety,  or 
any  combination  of  those  matters”  (DHS  2009). 

Risks  to  infrastructure  threaten  lives,  economic  stability,  and  national  security.  As 
defined  in  the  DHS  Risk  Lexicon  (DHS  2010),  risk  is  “potential  for  an  unwanted 
outcome  resulting  from  an  incident,  event,  or  occurrence,  as  determined  by  its  likelihood 
and  the  associated  consequences.”  (In  general,  we  follow  definitions  put  forth  in  this 
Lexicon.)  It  is  not  enough  to  merely  protect  against  initial  attacks  on  critical 
infrastructure  and  key  resources  (CI/KR).  As  described  in  the  NIPP,  we  must  be  prepared 
to  (1)  deter  attacks,  (2)  endure  their  impact,  and  (3)  regain  normal  operation  as  soon  as 
possible  (DHS  2009).  The  NIPP  aims  to  deter,  foil,  or  decrease  the  effects  of  purposeful 
attacks  and  to  increase  readiness,  responsiveness,  and  resiliency  of  CI/KR  in  the  event  of 
an  attack,  natural  disaster,  or  other  emergency  (DHS  2009).  The  NIPP  promotes 
cooperation  of  private  and  government  agencies  in  the  development  of  prevention, 
response,  mitigation,  and  recovery  efforts.  Providing  security  everywhere  at  all  times  is 
impossible  with  limited  personnel,  and  building  infrastructure  that  is  completely  resistant 
to  attack  is  difficult  with  limited  financial  resources.  This  intentional  defense  guidance 
outlined  in  the  NIPP  fosters  organizational  cooperation  to  overcome  inherent  limits  and 
achieve  necessary  readiness. 

The  Marine  Transportation  Security  Act  (MTSA)  of  2002  mandates  that  vessels 
and  ports  conduct  vulnerability  assessments  as  part  of  local  Area  Maritime  Security  Plans 
(Maritime  Transportation  Security  Act  of  2002).  The  USCG  Captain  of  the  Port  is  the 
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Federal  Maritime  Security  Coordinator  charged  with  oversight  of  the  local  Area  Maritime 
Security  Committee,  who  develops  and  implements  those  plans. 

Guided  by  the  NIPP,  DHS  evaluates  risk  as  a  function  of  threats,  vulnerabilities, 
and  consequences  and  then  applies  this  definition  of  risk  to  deliberate  and  non-deliberate 
events  indiscriminately.  The  DHS  has  adopted  Probabilistic  Risk  Assessment  (PRA)  to 
estimate  risk  and  prepare  for  potential  threats  from  both  natural  causes  and  malicious 
enemies  (see  Bedford  and  Cooke.  2001.  for  an  introduction  to  PRA).  In  this  context, 
threat  is  the  probability  of  attack,  vulnerability  is  the  conditional  probability  of  success 
given  an  attack,  and  consequence  is  the  result  of  successful  attack,  measured  either  in 
lives  lost  or  dollars  damage  (DHS  2009).  Examples  of  this  PRA  application  in  use  are  the 
Risk  Analysis  and  Management  for  Critical  Asset  Protection  (RAMCAP)  (ASME  2011), 
the  Terrorism  Risk  Assessment  and  Management  (TRAM)  toolkit  (NRC  2010),  and  the 
Maritime  Security  Risk  Analysis  Model  (MSRAM),  employed  by  the  USCG  (GAO 
2010).  Additionally,  the  DHS  conducts  data  calls  and  information  sharing  to  assess 
CI/KR  and  relies  on  the  aggregate  knowledge  of  its  personnel  to  accurately  assess 
vulnerability.  By  quantifying  risk  at  each  key  component  of  a  system,  the  goal  of  DHS  is 
to  allocate  defense  resources  judiciously  in  order  to  mitigate  risk.  One  example  of  these 
data-sharing  efforts  is  the  Constellation/ Automated  Critical  Asset  Management  System 
(C/ACAMS,  see  DHS  2012  for  details).  This  web-based  tool  allows  users  to  access  and 
share  CI/KR  information,  assess  vulnerabilities,  and  develop  reaction  plans.  These  types 
of  information  management  and  internal  assessments,  combined  with  probabilistic 
approach  to  attacks,  drive  DHS  risk  efforts  and  defense  planning. 

As  documented  by  the  National  Research  Council  (NRC  2008,  2010)  there  are 
problems  with  these  methods  of  evaluating  risk.  First,  there  is  not  enough  historical  data 
to  assess  probability  of  future  terrorist  attack,  and  it  is  questionable  in  this  context 
whether  past  events  are  representative  of  future  ones.  Relying  on  subjective  assessment 
from  subject  matter  experts  to  assess  probabilities  has  inherent  biases  and  simply  cannot 
be  validated  against  ground  truth.  Second,  deliberate  attacks  from  an  adversary  are 
distinctly  different  from  non-deliberate  events,  such  as  accidents,  failures,  or  natural 
disasters,  and  should  be  handled  separately.  Acts  of  nature,  for  example,  may  be  handled 
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with  a  probabilistic  approach,  as  these  acts  happen  as  random  occurrences  based  on 
seasonal  or  climatic  conditions,  or  on  engineering  failures  or  operational  errors,  and 
historical  data  is  readily  available  for  characterizing  these  probabilities.  Even  human 
errors  or  mishaps  can  be  characterized  by  probabilities.  But,  once  an  intelligent  adversary 
enters  the  scenario,  the  rules  change  (see  Engel  2011  for  a  detailed  discussion).  This 
adversary  has  harmful  motives  and  accomplishes  his  intent  through  thoughtful  planning 
and  observation  of  CI/KR.  The  actions  of  this  attacker  are  not  random,  but  deliberate.  To 
assume  that  an  adversary  behaves  according  to  known  probabilities  would  be  to  neglect 
the  autonomous  nature  of  the  enemy  at  our  own  peril. 

Brown  and  Cox  (2011)  raise  additional  issues  with  predicting  risk  based  on 
subjective  probability  estimates  of  possible  enemy  actions.  Specifically,  they  contend  that 
dismissing  the  differences  between  scenarios  involving  intelligent  adversaries  and 
random  threats  can  have  significant  consequences.  They  argue  that  threat-vulnerability- 
consequence  (TVC)  formula  “ Risk  =  (Probability  of  attack)  x  (Probability  that  attack 
succeeds,  given  that  it  occurs)  x  (Consequence  of  a  successful  attack)’’  is  a  poor 
estimator  of  risk,  amounting  at  best  to  a  guess  of  potential  risk.  Additionally,  they  point 
out  that  PRA  does  not  provide  decision  makers  insight  on  where  to  invest  resources  to 
mitigate  this  risk  and  note  that  probabilities  regarding  enemy  action  may  be  impossible  to 
correctly  predict.  Instead,  they  recommend  focusing  on  enhanced  infrastructure  and 
defense  efforts  that  improve  the  system’s  ability  to  rebound  from  an  attack  and  quickly 
return  to  satisfactory  operating  conditions.  Engel  (2011)  also  summarizes  some  of  the 
flaws  of  the  threat-vulnerability-consequences  approach  to  risk  in  the  context  of  system 
interdiction  models. 

Brown  and  Cox  (2011)  suggest  game  theory  as  a  superior  approach  to  PRA  when 
evaluating  risk  in  a  system.  Game  theory  considers  the  intelligent  decisions  of  both  the 
attacker  and  the  defender,  allowing  each  to  freely  choose  when,  where,  and  how  he  acts, 
but  admitting  that  defender  acts  will  be  visible  to  the  attacker.  This  more  closely 
represents  an  actual  defender  preparing  for  possible  threats,  an  attacker  seeking  to  inflict 
maximum  harm,  and  a  defender  (or  operator)  attempting  to  manage  his  system  in  a 
damaged,  degraded  condition.  Viewing  the  interaction  between  friendly  and  enemy 
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combatants  in  this  manner  eliminates  the  requirement  to  subjectively  identify 
consequences,  vulnerabilities,  and  threats  of  a  system  and  focuses  attention  on  the  CI/KR 
that,  if  attacked,  would  result  in  maximum  frustration  of  the  system. 

The  2010  NRC  review  of  DHS  approaches  to  risk  analysis  concludes: 

Conclusion:  These  network  disruption  and  systems  resilience  models 
(which  supplant  and  move  away  from  current  limitations  of  TVC  analyses 
for  CI/KR)  are  ideal  for  longer-tenn  investment  decisions  and  capabilities 
planning  to  enhance  infrastructure  systems’  resiliency,  beyond  just  site- 
based  protection.  Such  models  have  been  used  in  other  private  sector  and 
military  applications  to  assist  decision-makers  in  improving  continuity  of 
operations. 

Recommendation:  DHS  should  continue  to  enhance  CI/KR  data  collection 
efforts  and  processes  and  should  rapidly  begin  developing  and  using 
emerging  state-of-the  art  network  and  systems  disruption  resiliency 
models  to  understand  and  characterize  vulnerability  and  consequences  of 
infrastructure  disruptions.  (NRC  2010,  page  69) 

We  follow  this  guidance  to  evaluate  CI/KR  resiliency  on  the  Port  of  Pittsburgh. 

There  has  been  considerable  interest  in  the  use  of  game  theory  for  security 
problems.  Tambe  et  al.  (2011)  use  game  theory  to  consider  security  problems.  They 
formulate  a  Stackelberg  game  for  ports  and  inland  waterway  security  in  order  to  assist 
USCG  efforts  in  combating  terrorism.  The  Port  Resilience  Operational  /  Tactical 
Enforcement  to  Combat  Terrorism  (PROTECT)  model  is  an  example  of  the  application 
of  game  theory  techniques  to  defense  efforts  (Shieh  et  ah,  2012).  Additional  applications 
of  this  technique  include  Assistant  for  Randomized  Monitoring  Over  Routes  (ARMOR) 
in  the  Los  Angeles  International  Airport,  Intelligent  Randomization  in  Scheduling  (IRIS) 
in  the  U.S.  Federal  Air  Marshal  Service,  and  Game  Theoretic  Unpredictable  and 
Randomly  Deployed  Security  (GUARDS)  in  the  Transportation  Security  Agency 
(TEAMCORE  2011). 

B.  SYSTEM  INTERDICTION  MODELS 

Another  use  of  game  theory  has  been  to  consider  system  interdiction  problems. 
Wood  (1993)  introduces  a  detenninistic  interdiction  scenario.  He  details  the  usefulness  of 
this  technique  in  the  context  of  “reducing  the  flow  of  drugs  and  related  chemicals  through 
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river  and  road  networks  in  South  America”  (Wood  1993).  His  work  considers  two 
opponents,  with  a  smuggler  trying  to  maximize  the  amount  of  drugs  transported  through  a 
network  and  an  interdictor  trying  to  minimize  routes  to  achieve  this  objective.  Wood  uses 
a  small  14-node,  25-arc  sample  problem  to  portray  the  interactions  of  the  smuggler  and 
interdictor  on  a  capacitated  network.  He  also  considers  the  use  of  multiple  commodities 
and  other  variations  and  extensions  of  this  problem.  Our  problem  is  similar,  with  role 
reversals,  where  we  are  attempting  to  move  coal  across  a  network  and  the  interdictor  is  an 
intelligent  adversary,  seeking  to  cut  off  our  ability  to  traverse  the  system. 

Brown  et  al.  (2005,  2006)  introduce  Defender-Attacker-Defender  (DAD)  models 
to  represent  the  interaction  between  an  enemy  (attacker)  and  an  operator  (defender).  This 
three-move  game  begins  with  the  defender  analyzing  his  system  and  choosing  a  defense 
plan  to  minimize  the  effects  of  any  potential  attack.  He  may  increase  capacity,  improve 
security,  or  reinforce  vital  system  components.  The  next  move  belongs  to  the  attacker, 
who  evaluates  the  system,  having  full  knowledge  of  the  defender’s  defense  strategy  and 
then  attacks  to  inflict  maximum  damage.  Finally,  the  operator  attempts  to  manage  the 
damaged  system  to  minimize  the  impact  of  the  attack.  Wood  (2011)  provides  a  summary 
of  network  interdiction  problems  and  the  techniques  for  solving  them. 

Pidgeon  (2008)  develops  a  simulation  model  to  estimate  the  costs  associated  with 
disruptions  to  the  Marine  Transportation  System  (MTS),  specifically  incidents  at  the 
major  west  coast  ports  of  the  U.S..  He  explains  the  significance  of  western  ports  to  the 
domestic  economy,  as  these  ports  handle  the  majority  of  imported  containerized  cargo  for 
the  U.S..  He  considers  various  scenarios,  ranging  from  striking  union  workers  to 
earthquakes  in  California  that  could  cause  delays  in  the  handling  of  containerized  cargo. 
Pidgeon  considers  the  ability  of  government  agencies  to  advise  redirection  of  commercial 
vessels,  assuming  industry  leaders  would  make  wise,  lowest-cost  decisions  in  rerouting 
ships  to  alternate  available  ports.  Pidgeon’s  model  uses  queues  to  represent  ships 
awaiting  offload,  and  displays  growing  penalty  costs  related  to  infrastructure 
shortcomings.  The  model  analyzes  infrastructure  capacity  limitations  and  identifies  choke 
points  where  government  and/or  commercial  agencies  may  invest  to  mitigate  penalty 
costs  associated  with  delayed  shipments. 
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Bencomo  (2009)  analyzes  the  impact  of  various  disruptions  on  the  containerized 
transportation  system  into  and  out  of  North  America.  He  develops  an  Attacker-Defender 
(AD)  model,  looking  first  at  the  optimal  routes  of  shipment,  then  considers  the  effects  of 
an  intelligent  adversary,  workforce  strikes,  and  natural  disasters.  This  model  seeks  the 
most  efficient  means  to  transport  goods  from  source  to  destination  by  taking  advantage  of 
various  modes  of  transport.  He  considers  road,  rail,  and  water  travel  and  develops  a 
model  to  appropriately  choose  the  best  mode  of  travel  at  different  stages  of  delivery.  The 
model  seeks  the  most  cost-efficient  means  to  satisfy  supplies  and  demands.  He  suggests 
that  future  areas  of  study  investigate  more  accurate  representations  of  transport  systems. 
Additionally,  he  advocates  for  more  involvement  from  key  stakeholders,  to  better 
understand  the  true  ramifications  of  disruptions  on  the  system. 

De  la  Cruz  (2011)  evaluates  the  ability  of  the  MTS  to  import  various  goods  into 
Hawaii,  via  refrigerated  and  non-refrigerated  containers.  He  observes  that  the  large 
majority  of  consumer  goods  come  from  outside  the  island.  Due  to  the  limited  storage 
capacity  of  the  island,  the  system  is  fragile  and  cannot  easily  handle  disruptions,  making 
it  susceptible  to  attack.  Using  Attacker-Defender  modeling,  he  identifies  system 
components  (e.g.,  piers,  cranes,  and  tenninals)  that  are  vital  to  maintaining  the 
uninterrupted  flow  of  containerized  shipments.  His  work  assesses  how  well  the  Hawaiian 
MTS  handles  worst-case  disruptions  and  the  effect  of  those  disruptions  in  terms  of 
delivery  shortages.  By  identifying  key  components  of  the  system  and  analyzing  the 
system’s  resiliency  to  attacks,  de  la  Cruz  affords  government  agencies  and  other 
commercial  stakeholders  insight  into  greatest  areas  of  need  for  improved  equipment, 
increased  capacity,  and  better  policies. 

Babick  (2009)  challenges  conventional  risk  management  tools  used  by  the 
Department  of  Homeland  Security  and  compares  current  methods,  such  as  RAMCAP, 
with  AD  and  DAD  algorithms.  Babick  demonstrates  that  DAD  is  superior  to  the  risk- 
based  techniques,  consistently  providing  answers  that  are  as  good,  or  better.  Additionally, 
he  shows  that  results  from  the  DAD  model  provide  insight  into  necessary  improvements 
to  infrastructure,  an  advantage  over  the  risk  management  methods.  Focusing  on  the 
western  U.S.  rail  network,  Babick  explains  that  DAD  and  AD  produce  optimal  routes 
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following  an  attack  on  the  system.  This  exposes  the  susceptibility  of  certain  arcs  and 
nodes  throughout  the  network  and,  as  costs  to  redirect  traffic  rise,  encourages  further 
investigation  of  these  critical  pieces  of  infrastructure.  This  type  of  system  transparency  is 
not  available  in  traditional  PRA  risk  management  methods. 

Alderson  et  al.  (2011)  demonstrate  the  use  of  a  Defender- Attacker-Defender 
(DAD)  model  in  the  context  of  a  transportation  system  consisting  of  roads  and  bridges, 
and  they  provide  a  formal  algorithm  for  solving  the  DAD  tri-level  optimization  problem. 

Engel  (2011)  compares  risk-based  assessment  and  game-theoretic  techniques  as 
viable  USCG  approaches  to  defending  critical  infrastructure  against  attack.  The  medium 
for  this  analytic  comparison  is  the  evaluation  of  the  flow  of  coal  along  a  particularly 
small  portion  of  the  Pittsburgh  region.  He  develops  an  Attacker-Defender  model, 
consisting  of  roads,  railways,  and  rivers,  to  determine  critical  vulnerabilities  to  the 
shipment  of  a  single  commodity  (coal)  from  mines  to  power  plants  and  steel 
manufacturers.  Using  notional  data,  his  analysis  provides  proof-of-concept  about  the 
potential  insights  from  a  more  rigorous  study. 

C.  CONTRIBUTIONS  OF  THIS  THESIS 

The  primary  contribution  of  this  thesis  is  the  development  of  an  Operator’s  Model 
that  mimics  the  real-world  behavior  of  coal  transport  in  the  Port  of  Pittsburgh  and  allows 
for  systematic  investigation  of  “what  if’  scenarios. 

Building  on  the  work  done  by  Engel  (2011),  we  expand  the  area  of  operation  to 
include  more  mines  and  factories.  We  consider  the  movement  of  multiple  types  of  coal, 
as  contracted  between  individual  suppliers  and  consumers.  These  changes  add 
complexity,  yet  provide  more  realistic  traffic  flow,  and  a  better  understanding  of  the 
system  in  the  Pittsburgh  area. 

We  include  multiple  commodities,  in  the  spirit  of  de  la  Cruz  (2010),  and  multiple 
modes  of  transport  as  in  Bencomo  (2009).  This  produces  a  model  that  is  closer  to  reality 
and  provides  further  understanding  of  the  interaction  of  these  commodities  on  a 
complicated  network. 
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III.  RIVER  TRANSPORT 


The  starting  point  of  any  analysis  of  critical  infrastructure  is  to  understand  its 
basic  function  and  operations,  so  as  to  be  able  to  assess  the  consequences  of  disruption  to 
that  function.  River  transportation  is  a  primary  means  of  moving  large  quantities  of  bulk 
commodities.  Although  rail  lines  and  roads  are  important  shipment  modes,  rivers  garner 
special  attention  in  this  thesis.  Because  coal  accounts  for  76%  of  river  traffic  by  volume 
through  the  Port  of  Pittsburgh  (PPC  2010),  we  provide  a  more  detailed  description  of 
river  shipment 

The  Monongahela  and  Allegheny  Rivers  converge  to  form  the  Ohio  River  at  the 
Point  of  Pittsburgh.  Figure  4  depicts  our  area  of  interest  (AOI)  around  Pittsburgh, 
including  the  many  locks  and  dams.  These  three  rivers  stretch  more  than  300  miles  and 
provide  both  public  recreation  and  enormous  commercial  shipping  capacity.  These  rivers 
also  flow  through  the  most  extensive  coal  bed  in  the  Appalachian  Basin  (Puglio  1983). 
Exploitation  of  coal  in  this  region  began  as  early  as  1751  (White  1898).  Companies  in  the 
area  are  faithful  consumers  of  coal  and  many  rely  solely  on  this  local  commodity  for 
producing  steel  and  generating  electricity. 

The  characteristics  of  coal  vary  regionally,  and  coal  is  rated  on  its  bum  quality. 
“Coal  is  classified  into  four  main  types,  or  ranks  (anthracite,  bituminous,  sub-bituminous, 
and  lignite),  depending  on  the  amounts  and  types  of  carbon  it  contains  and  on  the  amount 
of  heat  energy  it  can  produce”  (U.S.  Energy  Information  Administration,  2012).  Each 
coal  consumer  must  balance  costs,  including  delivery  fees,  with  quality  when  purchasing 
contracts.  This  further  complicates  matters  on  the  river,  as  consumers  are  not  simply 
buying  from  the  nearest  mine,  but  rather  buying  the  type  of  coal  they  need  from  the  mine 
company  that  offers  the  best  price.  This  results  in  non-obvious  delivery  routes,  including 
many  instances  of  coal  being  delivered  to  and  from  locations  outside  our  AOI. 


15 


River  Locks  &  Dams 


Ohio  River 
Emsworth  L/D 
Dashields  L/D 
Montgomery  L/D 
New  Cumberland  L/D 
Pike  Island  L/D 
Hannibal  L/D 
Allegheny  River 
Allegheny  L/D  2 
C.W.  Bill  Young  L/D  3 
Allegheny  L/D  4 
Allegheny  L/D  5 
Monongahela  River 
Braddock  L/D 
Monongahela  L/D  3 
Monongahela  L/D  4 
Maxwell  L/D 
Grays  Landing  L/D 
Point  Marion  L/D 
Morgantown  L/D 


Figure  4.  The  Port  of  Pittsburgh  consists  of  the  Ohio,  Monongahela,  and  Allegheny 
Rivers.  This  picture  illustrates  the  location  of  various  locks  and  dams  (L/D) 
throughout  our  AOI,  listed  in  the  table  to  the  right.  Along  the  Ohio  River 
our  AOI  is  bounded  by  the  Hannibal  L/D.  Along  the  Allegheny  River  our 
AOI  is  bounded  by  the  Allegheny  L/D  5 .  Along  the  Monongahela  River  our 
AOI  is  bounded  by  the  Morgantown  L/D.  Source:  USACE  2012. 


Locks  and  dams  make  river  travel  possible.  Dams  maintain  the  water  level,  so 
large  vessels  can  transit  without  running  aground.  The  body  of  water  between  two  dams 
is  known  as  a  pool.  Dams  create  a  tiered  effect  between  pools  throughout  the  river 
network.  Figure  5  illustrates  the  sequences  of  pools  on  the  Monongahela  River  upstream 
of  and  including  Pittsburgh. 
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Figure  5.  Dams  and  pools  on  the  Monongahela  River.  Source:  USAGE  2012.  The  failure  of  the  Monongahela  L/D  4  results  in  the 
loss  of  navigatbility  of  the  river  segment  or  pool  between  the  Monongahela  L/D  4  and  the  Maxwell  L/D.  Such  a  failure 
implies  the  inability  to  transport  coal  via  river  to  or  from  any  facilities  (i.e.,  mines  or  plants)  located  within  that  pool. 
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Locks  enable  vessels  to  transition  from  one  pool  to  the  next  (Figure  6).  Passing 
through  a  lock,  known  as  “locking-through,”  can  take  30  minutes  to  several  hours, 
depending  on  queuing,  number  of  barges,  and  the  number  of  parallel  locks  available  for 
use. 


Figure  6.  Aerial  view  of  Emsworth  Lock  and  Dam,  Pittsburgh,  PA.  There  are  two 
parallel  locks  (at  right)  that  allow  passage  between  the  pools  of  water 
separated  by  the  dam  (at  left).  Source:  USACE  2012. 

The  USACE  has  responsibility  for  the  continued  operation  of  these  waterways.  In 
total,  the  USACE  operates  and  maintains  12,000  miles  of  commercial  inland  navigation 
channels,  including  dredging  riverbeds  and  repairing  the  600  dams  under  its 
responsibility  (USACE  2012).  Because  of  aging  infrastructure  throughout  the  river 
system,  scheduled  maintenance  on  locks  and  dams  creates  delays  of  weeks  to  months. 
These  planned  repairs  are  announced  to  the  public  far  in  advance.  The  USCG  also  uses 
their  website  to  notify  the  public  of  delays,  blockages,  and  expected  river  conditions  in 
nearly  real-time.  The  average  age  of  the  192  inland  waterway  locks  is  50  years  old  (Gillis 
2009).  In  the  event  of  catastrophic  damage,  the  USACE  relies  heavily  on  established 
contractor  support.  Pursuant  to  the  National  Response  Framework  (DHS  2008),  the 
USACE  assists  DHS  with  engineering  support  and  construction  supervision,  handling 
significant  debris  removal  and  demolition  when  the  situation  is  unmanageable  at  the  local 
or  state  level.  The  Monongahela  River  has  two  of  the  oldest  locks  maintained  by  the 
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USACE,  built  in  1905  and  1907.  In  Calendar  Year  2009  together  they  locked  10,602 
vessels  carrying  26,044,941  tons  of  cargo  (USACE  2012).  Sudden  loss  of  a  dam  would 
have  cascading  affects,  damaging  infrastructure  downstream. 

Disruptions  along  the  waterways  range  from  mere  inconveniences,  such  as  minor 
maintenance,  to  long-term  outages  resulting  from  dam  failure.  This  range  of  possibilities 
carries  varying  consequences,  including  increased  costs  to  operate  the  system.  These 
incremental  cost  increases  are  clearly  undesirable.  In  September  of  2009,  Michael 
Hennessy,  Vice  President  of  river  operations  for  CONSOL  Energy,  said,  “A  catastrophic 
breakdown  of  one  of  the  Monongahela  river’s  aging  locks,  namely  the  100-year-old  Lock 
3,  would  bring  hundreds  of  thousands  of  tons  of  barge  traffic  to  an  abrupt  halt  with  little 
opportunity  to  quickly  or  efficiently  divert  the  cargo  to  other  land-based  transport  modes” 
(Gillis  2009). 

Natural  disruptions  along  the  river  may  result  from  flooding,  freezing, 
infrastructure  failure,  or  large  debris  (i.e.,  a  sunken  vessel).  Some  delays  are  scheduled, 
while  others  are  unanticipated  and  result  from  seasonality  or  random  happenings. 
Maintenance  downtime  can  last  from  weeks  to  months,  but  auxiliary  locks,  and  small 
temporary  locks  used  to  mitigate  complete  stoppage,  alleviate  some  of  the  backlog  of 
barges.  The  need  for  unscheduled  maintenance  increases  as  critical  components  fail  from 
years  of  use. 

Another  class  of  disruption  includes  deliberate  attacks  from  a  malicious  agent. 
These  types  of  attacks  may  include  destroying  critical  infrastructure  (e.g.,  locks,  dams,  or 
bridges)  and  are  more  challenging  to  prepare  for.  A  May  2012  attempt  to  attack  nearby 
infrastructure  using  “explosive  materials  to  damage  physical  property  affecting  interstate 
commerce,”  is  a  real-world  example  of  such  an  attempt  at  disruption  (Barrett  2012). 

Figure  7  shows  that  delays  have  increased  over  time  as  a  result  of  scheduled  and 
nonscheduled  maintenance. 
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Figure  7.  Unscheduled  lock  outages.  Source:  Smith  (Coal  Power  Magazine),  2007. 


The  fragility  of  this  shipping  network  and  the  limited  resources  of  the  USCG  and 
USACE  make  the  Port  of  Pittsburgh  vulnerable  to  long-term  disruption.  Applying  game 
theory  system  interdiction  techniques  to  this  problem  will  pinpoint  CI/KR  components 
whose  loss  has  the  biggest  impact  on  system  function.  This  proactive  approach  will 
identify  vulnerabilities  in  the  context  of  a  malicious  adversary  and  will  aid  decision 
makers  as  they  prepare  for  worst-case  scenarios  and  defend  critical  lines  of  commerce. 
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IV.  THE  OPERATOR’S  MODEL 


The  transport  of  coal  through  Pittsburgh  is  driven  by  contracts  between  suppliers 
and  consumers.  These  shipping  contracts  are  satisfied  through  the  movement  of  coal  by 
barge,  train,  and  truck  from  mines  to  customer  destinations  within  our  AOI.  These 
contracts  link  the  delivery  of  a  specific  commodity  from  a  specific  supplier  to  a  specific 
consumer  at  a  specific  time. 

We  model  a  multi-commodity  transshipment  system  in  which  each  commodity 
(i.e.,  each  individual  contract)  can  travel  along  multiple  modes  of  transport,  each  having 
different  capacity  and  cost.  We  consider  two  types  of  coal  (bituminous  and  lignite)  and 
keep  track  of  contracted  shipments  by  destination  (customer)  and  week  of  delivery.  Thus, 
a  “commodity”  in  this  model  is  in  fact  a  combination  of  (coal  type,  source,  destination, 
and  delivery  week). 

We  partition  the  set  of  nodes  into  two  types.  “Terminal”  nodes  are  the  origins  and 
destinations  of  flow,  they  can  store  commodity  inventory,  and  they  are  not  associated 
with  any  particular  mode  of  transportation.  A  tenninal  is  a  place  where  coal  is  supplied, 
consumed,  and/or  stored  or  a  place  where  coal  is  transferred  on  or  off  one  of  the  three 
modes  of  transport.  In  contrast,  each  “transshipment”  node  is  associated  with  a  specific 
mode  of  transportation,  and  it  cannot  originate,  tenninate,  or  store  commodities. 

Accordingly,  there  are  two  types  of  arcs.  “Transfer  arcs”  move  commodity 
between  tenninal  nodes  and  transshipment  nodes.  “Transshipment  arcs”  move 
commodity  between  transshipment  nodes.  Commodities  can  move  from  one  mode  of 
transportation  to  another  only  by  transiting  through  a  terminal  node.  Additionally,  modes 
of  shipment  have  finite  capacities  with  varying  costs.  Cranes,  conveyors,  excavators,  and 
other  innovative  means  accomplish  loading  and  offloading.  These  arcs  have  both  a 
capacity  (i.e.,  equipment  limitations)  and  cost  (loading  cost  of  $0.15  per  ton  and 
offloading  cost  of  $0.30  per  ton).  The  drawing  in  Figure  8  illustrates  the  relationship 
tenninal  nodes  have  with  modal  (i.e.,  river,  rail,  or  road)  transshipment  nodes,  enabled  by 
intennodal  transfer  arcs. 
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Figure  8.  Transfer  arcs  between  a  terminal  node  and  transshipment  nodes  for  each  of 
the  three  modes  of  transportation  considered  in  this  thesis.  Capacities  on 
transfer  arcs  may  limit  the  ability  to  move  coal  to  or  from  an  individual 
mode  of  transportation. 


We  consider  the  movement  of  coal  over  a  time  horizon  ranging  from  one  to 
several  weeks.  The  only  interaction  between  time  periods  is  through  commodity 
inventory  that  is  carried  from  one  time  period  to  the  next  at  a  terminal  node. 

To  understand  how  the  system  functions  in  the  presence  of  disruptions,  we  must 
first  understand  how  the  system  functions  under  normal  operations.  We  begin  with  the 
assumption  that  all  coal  is  transported  via  river  during  standard  operating  conditions. 
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A.  MODEL  FORMULATION 

We  present  the  formal  mathematical  model  of  system  operations,  in  Naval 
Postgraduate  School  standard  form  (amended  27  July  2012). 


Index  Sets  [-cardinality!: 
n  eN 
r  gRqN 
d  e/J  cz  TV 
m  eM 

mx  e  MX  -  MV  transfer ' 


nodes [-100] 

transshipment  nodes  (alias  i,j) 

tenninal  nodes  (alias  o,s)  R n D  =  0;  f?  u D  =  (V 

modes  of  transport;  M=  {river,  rail,  road,  transfer} 


{m,i,j}  eA^MxNxN  directed  arcs  (from  node  i  to  node  j  using  mode  m)  [-500] 
{m,i,j}  e  U  |  {m,i,j}  eAv  e  A  undirected  arcs  [-250] 

time  periods  (alias  wd)  [weeks,  -50] 
time  periods  w  during  which  shipments  can  be  made  for 
contracts  due  in  time  period  wd(w<wd  )[~50] 
if  arc  imd,j}  is  damaged,  it  is  still  inoperable  during  time 
period  w  [-500] 
cargo  type  [-2] 
contract  commodity  [-1,000] 


weW 

{w,  wd}  e  FORE  _  LOG 

{; m,i,j,w }  e  ARC  I 


c  eC 

{c,d,wd}  e  COM 


Input  Data  [units]: 

contract^  dwd 


cost,. 


CPeno,M 
hcosts 
inv  cap  s 


amount  of  cargo  type  c  originating  at  node  o  contracted  for 

delivery  to  node  d  during  time  period  wd  [tons] 
cost  per  unit  flow  for  using  arc  {m,i,  j}  e  A  [cost] 

per-unit  penalty  for  failing  to  deliver  contract  volume  [cost/ton] 
holding  cost  for  inventory  at  terminal  s  [cost/ton] 
inventory  capacity  at  terminal  s  [tons] 
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spens 


ATTACK  m,ij 

CaP>n,iJ 

UCaPm,i,j 

Computed  Data: 

demand  c4iWd 


per-unit  demand  shortfall  penalty  at  node  s  of  cargo  type  c 
[cost/ton] 

binary  indicator  as  to  whether  arc  {m,i,j}  e  A  is  damaged; 

=  1  if  arc  {m,i,j}  is  damaged,  =  0  otherwise  [binary] 

per  unit  flow  penalty  for  using  arc  {m  ,i,  jj  e  A  if  damaged  [cost] 

directed  capacity  of  arc  {m,i,j{  e  A  [tons] 

undirected  (shared)  capacity  of  arcs  {m,i,j}  e  A  and  {m,j,i}  e  A  ? 
i  <j  [tons] 

demand  for  cargo  type  c  at  node  d  at  during  time  period  wd  [tons] 
demand cdwd  =  YjContmcto,c,dM 

oeN 


Non-negative  Decision  Variables  [units]: 

Fowcd  wd  flow  from  mine  o  during  time  period  w  of  contract  cargo  {c,d,wd} 
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Formulation  1 :  Defender  Model  (D) 
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The  objective  (SO)  measures  the  total  transit,  transfer  and  inventory  holding  cost, 
plus  any  penalties  for  shortfalls  or  contract  violations.  The  “attack”  terms  will  be 
discussed  in  a  following  section,  but  here  merely  represent  arcs  whose  costs  have  risen  so 
dramatically  they  will  not  be  used.  Each  constraint  (SI)  ensures  for  some  contract  that 
total  flows  from  the  source  mine  meet  the  contract  amount.  Note  that  in  case  of 
anticipated  disruptions,  flows  may  leave  the  mine  earlier  than  the  delivery  contract  week 
to  be  stored  in  intermediate  inventory  somewhere  and  conveyed  to  the  customer  later. 
Each  constraint  (S2)  accounts  for  balance  of  flow  at  some  transfer  node  at  the  start  of  a 
planning  period  for  some  commodity.  Each  constraint  (S3)  accounts  for  inter-modal 
transfers  at  some  terminal  node  of  come  commodity,  including  inventory,  shortfall, 
supply,  and  demand.  Constraints  (S4)  and  (S5)  enforce  directed  and  undirected  capacity 
on  arcs,  respectively.  Each  constraint  (S6)  limits  inventory  held  at  some  terminal  at  the 
start  of  some  planning  period. 

This  model  finds  the  minimum  cost  means  of  delivering  the  contracted  amount 
from  each  source  to  each  destination,  along  one  of  several  modes  of  transport,  each 
having  their  own  costs  and  capacities.  An  interdiction  on  an  arc  increases  its  usage  cost, 
so  if  there  is  a  disruption  in  one  system  (e.g.,  river),  then  the  model  looks  for  a  low-cost 
alternative  route  (e.g.,  river,  rail,  or  road).  There  is  a  penalty  ( cpenC0d )  for  violating 
delivery  of  contracted  amounts  (e.g.,  by  satisfying  a  customer  from  an  alternative 
supplier),  but  in  general  this  penalty  is  less  than  the  penalty  for  incurring  a  customer 
shortfall  ( spensc ). 

The  model  has  the  flexibility  to  move  and  store  coal  in  advance  of  its  contract 
delivery  date.  This  is  advantageous  when  planning  for  scheduled  maintenance  or  when 
buffering  inventories  to  reduce  the  impact  of  unplanned  disruptions.  This  functionality  is 
controlled  by  the  FORE  LOG  mechanism  in  the  formulation,  which  maintains  an  aspect 
of  realism  in  delivery  planning  by  limiting  the  model’s  forecasting  ability.  A  reasonable 
use  of  this  mechanism  might  be  to  allow  the  model  to  plan  ahead  and  move  coal  up  to 
four  weeks  in  advance.  This  prevents  the  model  from  transporting  all  coal  in  the  first 
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week  of  operations,  limited  only  by  infrastructure  capacity.  This  unrestricted  movement 
of  coal  is  inconsistent  with  industry  practice,  which  is  more  similar  to  a  Just-In-Time 
system. 

This  thesis  only  uses  a  single  time  period  of  one  week,  a  restriction  that  could  be 
used  to  considerably  simplify  the  model  exposition.  However,  we  have  chosen  to  display 
the  full  model  for  a  multi-time  period  planning  horizon  and  show  how  shipments  can 
preposition  contracts  and  how  demand  can  be  satisfied  before  anticipated  future  losses  of 
system  components. 

B.  BUILDING  THE  NETWORK 

In  this  section,  we  describe  how  we  use  infonnation  about  the  real  system  to 
develop  data  that  we  can  use  as  input  to  the  Operator  Model  formulation.  The  goal  is  to 
have  our  mathematical  model  mimic  real-world  behavior. 

Dams  separate  rivers  into  pools,  enabling  navigability.  Locks  allow  movement 
from  one  pool  to  the  next.  Figure  9  illustrates  this  concept  of  segmenting  rivers  and 
provides  a  numbering  system  throughout  the  Port  of  Pittsburgh. 


Dams  separate  the  river 

into  pools. 

Locks  allow  movement  between  pools.  (lo() 

J  (90)  Mp3<M 

^  vcF  ^  □  Lock  #4 

© 

/**  ft  L  ,  © 

mp  54.4 

© 

Pike  Island  Lock  &  Dam  1 — | 

Lock #4 

MP84.2 

© 

C^3maxwell  Lock  &  Dam 
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MP61.2 
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Hannibal  Lock  &  Dam  a. 

MP  126.4^^ 
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^^"^Grays  Landing  Lock  &  Dam 

y  *' 

_>^PniNT  Marion  Lock  &  Dam 

©- 

Morgantown  LocK^^f 

© 

Figure  9.  Dams  segment  the  river  into  pools,  which  are  numbered.  Locks  enable 
transit  between  pools.  The  Hannibal  L/D  and  the  Pike  Island  L/D  on  the 
Ohio  River  form  Pool  10. 
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Our  numbering  scheme  for  locations  is  as  follows.  Starting  at  the  downstream  end 
of  the  AOI,  we  assign  each  river  pool  an  increasing  multiple  of  10.  We  assign  each  river 
terminal  associated  with  that  pool  a  number  equal  to  the  pool  plus  a  value  1-9 
representing  its  relative  geographic  location  within  the  pool.  The  result  is  that  the 
locations  are  naturally  sorted  (from  downstream  to  upstream)  according  to  their 
identification  numbers  (low  to  high).  The  simplified  river  network  in  Figure  10  illustrates 
the  use  of  the  pool  identification  numbering  convention  and  the  relationship  terminals 
share  in  a  pool. 


Figure  10.  Simplified  river  system  showing  a  total  of  44  terminals  connected  to  18 
pools.  Terminal  16  is  located  in  Pool  10. 


Terminals  also  connect  to  the  rail  and  road  network  in  a  similar  manner.  Figure  1 1 
shows  the  rail  and  road  networks,  including  illustrative  bridges  that  cross  rivers  and 
connect  land  masses. 
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Figure  11.  Simplified  river,  rail,  and  road  system,  with  bridges  connecting  landmasses 
by  crossing  over  rivers. 


This  overall  network  has  several  different  kinds  of  arcs  that  play  specific  roles  in 
our  analysis. 

•  Transfer  arcs  from  terminal  nodes  to  and  from  transshipment  nodes  represent  the 
ability  to  move  commodity  on  or  off  a  particular  mode  of  transport.  The  capacities 
of  these  arcs  are  constrained  by  the  physical  equipment  and/or  processes  available 
for  loading  and  unloading  coal.  An  interdiction  on  a  transfer  arc  means  that  the 
terminal  cannot  send  or  receive  coal  from  that  transport  mode. 

•  Arcs  connecting  pools  represent  the  ability  to  move  commodity  through  the  locks 
separating  the  pools.  An  interdiction  on  such  an  arc  results  in  the  inability  to 
move  commodity  between  pools. 
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•  Arcs  representing  commodity  movement  within  a  pool.  In  order  to  represent  an 
attack  on  a  dam  that  could  result  in  the  loss  of  an  entire  river  pool,  we  “split”  each 
pool  node  into  an  “inbound”  and  “outbound”  node  and  connect  these  with  a  single 
directed  arc  (see  Ahuja,  Magnanti  and  Orlin  1993,  p.  41-42  for  a  discussion  of 
this  “node  splitting”  technique).  An  interdiction  on  this  single  arc  results  in  the 
inability  to  move  commodity  within  the  pool. 

•  Arcs  representing  movement  on  rail  or  road  segments.  Bridges,  in  particular,  can 
form  bottlenecks  that  constrain  movement  on  land;  interdictions  on  these  arcs 
represent  restrictions  of  such  movement. 

Each  of  the  arcs  in  our  network  has  an  associated  cost  and  capacity,  which  are  important 
factors  in  how  the  Operator’s  Model  chooses  to  route  commodity  flow. 

C.  CAPACITY  AND  COST 

1.  Capacity  of  Rivers 

For  the  purposes  of  our  analysis,  we  assume  a  river  has  limitless  capacity.  Barges 
travel  at  a  speed  of  roughly  4  miles  per  hour  and  are  restricted  to  the  geographical 
contours  of  the  river.  However,  navigating  a  lock  limits  throughput.  Barges  can  carry 
1,500  tons  of  cargo.  A  standard  barge  tow  consists  of  12  to  15  barges  tied  together 
(National  Waterways  Foundation  2008).  A  standard  barge  tow  can  take  from  two  to  eight 
hours  to  pass  through  a  lock  (Waterways  Council  2011).  Assuming  24  hours  of  operation 
per  day  and  7  days  of  operation  per  week,  we  have  a  capacity  of  (75  barges  per  barge 
tow  x  1,500  tons  per  barge  x  8  barge-tows  per  hour  x  24  hours  per  day  x  7  days  per 
week  =)  30.24  million  tons  per  week. 

The  costs  of  transporting  commodities  by  river  are  less  than  other  modes  of  travel. 
The  Port  of  Pittsburgh  Commission  states  the  average  cost  per  ton-mile  by  barge  is 
between  $0,005  and  $0.01  (PPC  2012b).  For  the  purpose  of  this  analysis,  we  will  use  a 
cost  per  ton-mile  of  $0,008. 
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2.  Capacity  of  Rail  (Including  a  Discussion  on  Bridges) 

A  jumbo  hopper  rail  car  can  carry  approximately  100  tons  of  cargo.  Coal  train 
length,  measured  by  the  number  of  railcars  coupled  together,  is  limited  by  the  number  of 
engines  employed,  steepness  of  track  grades,  Department  of  Transportation  (DOT) 
regulations  (DOT  2012),  and  other  mechanically  limiting  factors  such  as  air-brake 
restrictions.  A  typical  coal  train  can  safely  pull  150  fully  loaded  coal  hoppers.  Each  coal 
train  then  carries  ( 100  tons  of  cargo  per  hopper  x  150  fully  loaded  hoppers  per  train  =) 
15,000  tons. 

Like  locks  on  a  river,  bridges  can  create  bottlenecks  for  rail  traffic,  as  only  a  finite 
number  of  trains  can  traverse  the  bridge  during  a  given  time  epoch.  A  2006  survey 
established  there  are  446  bridges  within  the  Pittsburgh  city  limits,  the  most  of  any  city  in 
the  world,  surpassing  Venice,  Italy  (Regan  2006).  A  train  of  150  cars  is  (46  feet  long  per 
hopper  carx  150  hopper  cars  =)  7,000  feet  long  (Environmodal  2012).  At  a  safe  speed  of 
15  miles  per  hour  (Norfolk  Southern  Railroad  Company  2012),  including  stops,  (15  mph  / 
7,000ft  =)  11.3  trains  per  hour  could  pass  a  given  point.  This  speed  includes  loading, 
offloading,  stops,  and  operational  time.  Operating  24  hours  per  day  and  7  days  per  week 
results  in  a  maximum  capacity  of  (11.3  trains  per  hour  x  24  hours  per  day  x  7  days  per 
week  =)  1,898  trains,  with  a  total  cargo  capacity  of  (1,898  trains  x  15,000  tons  per  train 
=)  28.5  million  tons  per  week. 

Additional  capacity  limitations  include  the  number  of  rail  lines  and  the 
availability  of  rail  cars  and  engines.  Trains  are  constrained  to  tracks.  While  this  might 
seem  restrictive,  it  does  provide  more  route  diversity  than  barges  constrained  to  rivers. 

The  average  cost  to  move  coal  by  rail  car  is  $0.05  per  ton-mile  (PPC  2012b). 

3.  Capacity  of  Roads  (Including  Bridges) 

A  conservative  estimate  of  the  maximum  capacity  of  a  coal-carrying  truck  is 
25  tons  (The  Energy  Library  2009).  Trucks  provide  the  most  flexibility  of  any  mode  of 
transportation.  Trucks  are  typically  employed  only  for  short  movements  as  the  costs  to 
move  such  small  volume  quickly  erase  potential  profits. 
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Again,  bridges  create  bottlenecks  and  limit  total  throughput.  There  are  a  total  of 
75  road  bridges  within  our  AOI  that  cross  the  Ohio,  Monongahela,  and  Allegheny  rivers. 
The  average  weekly  traffic  over  some  of  Pittsburgh’s  busiest  bridges  in  2009  was  around 
20,000  vehicles  per  day  (less  than  10%  or  2,000  were  trucks)  (City-Data  2012). 
Assuming  anything  greater  than  a  50%  increase  in  traffic  would  halt  movement,  we  take 
30,000  ( 20,000  +  .50  x  20,000)  as  the  maximum  capacity  of  any  bridge  during  a  day. 
This  represents  a  500%  increase  in  truck  traffic,  which  would  be  significant,  but 
necessary  for  emergency  rerouting.  The  10,000  trucks  equates  to  ( 10,000  vehicles  per  day 
x  7  days  per  week  x  25  tons  per  truck  =)  1.75  million  tons  of  coal  per  week  by  road. 

Transporting  coal  by  trucks  on  roads  is  the  most  expensive  option  at  $0.10  per 
ton-mile  (PPC  2012b). 

4.  Capacity  of  Terminals 

Terminals  are  locations  with  the  capacity  to  load  and/or  offload  cargo  or  to 
transfer  commodities  from  one  mode  of  shipment  to  another.  Each  tenninal  is  unique  and 
may  possess  different  kinds  of  heavy  lifting  equipment  (e.g.,  conveyors,  electric  whirler 
cranes,  hoists,  or  clamshell  buckets).  The  availability  of  commodity-transferring  assets 
presents  capacity  limitations  at  each  terminal.  Transfer  capacity  may  vary  by  mode  of 
transport. 

Additionally,  some  tenninals  are  not  accessible  by  every  mode  of  transportation. 
For  instance,  some  terminals  do  not  have  rail  lines  or  have  limited  road  access. 

The  speed  of  commodity  transfers  also  presents  capacity  limitations.  Offloading 
and  loading  does  not  happen  instantaneously.  Large  shipments  of  coal,  up  to  15  barges 
each  carrying  1,500  tons  of  coal,  take  time  and  manpower  to  move.  Each  piece  of 
commodity-moving  equipment  operates  at  a  different  speed  and  some  tenninals  are  not 
outfitted  with  the  newest  technology  or  the  fastest  equipment. 

For  the  purposes  of  our  analysis,  we  assume  the  average  cost  for  loading  coal  onto 
barges,  rail  cars,  or  trucks  is  $0.15  per  ton.  Because  offloading  is  more  labor  intensive 
and  costs  are  higher,  we  assume  the  cost  of  this  is  $0.30  per  ton. 
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D.  INVENTORY 


In  our  Operator’s  Model,  any  terminal  node  can  carry  inventory  to  facilitate  low- 
cost  transport  of  coal.  In  practice,  however,  power  plants  typically  carry  a  certain  amount 
of  inventory,  on  average  45  days,  in  order  to  compensate  for  interruptions  in  supply  such 
as  miner’s  strikes  and/or  holidays,  adverse  weather  or  transportation  problems  (Phillips 
2008).  Methods  of  storage  are  closed  silos  and  open  storage. 

E.  REPAIR  TIMES 

When  a  piece  of  infrastructure  is  damaged,  whether  by  deliberate  or  non- 
deliberate  means,  it  is  not  necessarily  lost  forever.  Repairs  to  river,  rail,  or  road 
infrastructure  take  time,  but  are  often  joint  efforts  by  government  and  non-government 
agencies.  For  the  purposes  of  our  analysis,  repair  times  for  critical  infrastructure  are 
measured  in  weeks.  We  simplistically  assume  that  transfer  equipment  (i.e.,  conveyors  or 
cranes)  take  two  weeks  to  repair.  Locks  are  uniquely  constructed  and  repairs  are  labor- 
intensive  tasks  that  we  assume  take  four  weeks  each.  Dams  are  the  most  time-consuming 
repairs,  assumed  here  to  take  13  weeks  each.  Roads  and  rail  lines  are  typically  repaired 
within  one  week;  therefore  we  consider  their  repair  times  to  be  negligible,  as  these  repairs 
can  be  accomplished  within  a  single  model  time  period. 

F.  TRAFFIC  DEMAND  BY  ORIGIN-DESTINATION 

The  U.S.  Anny  Corps  of  Engineers  (USAGE)  maintains  lock  throughput  data  for 
the  entire  inland  waterways.  Our  study  considers  2009  data  for  the  Port  of  Pittsburgh. 
This  data  contains  the  following  noteworthy  fields  of  information: 

•  Commodity  Name, 

•  Origin  Name, 

•  Destination  Name, 

•  Delivery  Date,  and 

•  Tons. 

Working  with  the  USCG,  USAGE  provided  a  comma-separated-value  (csv)  file 
with  over  20,000  lines  of  data  representing  individual  movements  of  coal.  Given  this 
extremely  valuable  source  of  information,  we  face  two  challenges.  First,  we  need  to 
understand  whether  these  historical  coal  flows  have  structure  that  could  perhaps  provide 
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insight  into  the  most  critical  parts  of  the  river.  Second,  we  need  to  get  the  data  in  a  form 
that  can  be  used  by  our  mathematical  AD  model,  which  we  implemented  in  the 
Generalized  Algebraic  Modeling  System  (GAMS)  (GAMS  2012).  To  address  these 
challenges,  we  use  Visual  Basic  for  Applications  (VBA)  in  Microsoft  Excel  (Microsoft 
Corporation  2012)  to  manipulate,  sort,  filter,  and  aggregate  the  data.  This  section 
describes  this  data  development  and  its  insights. 

1.  Data  Preprocessing 

Our  raw  data  includes  numerous  commodities,  such  as  grain,  gravel,  and 
petroleum-based  products,  but  the  data  also  includes  lignite  coal  and  bituminous  (a.k.a. 
coke)  coal.  Coal  is  of  sole  importance  to  this  study.  Because  we  focus  exclusively  on  coal 
movement,  we  filter  out  non-coal  goods,  leaving  around  15,000  lines  of  data. 

Next,  we  transform  the  data  into  a  form  that  follows  a  standard  naming 
convention  and  adheres  to  the  requirements  for  use  in  GAMS  (e.g.,  use  of  underscore 
characters  instead  of  spaces).  We  reduce  commodity  names  to  simply  COAL  A  or 
COAL  B.  We  assign  each  origin  and  destination  location  a  unique  identification  number 
as  a  programing  simplification  and  in  order  not  to  reveal  sensitive  data  that  exposes 
specific  customer  relationships.  Additionally,  we  associate  each  location  with  a  specific 
river  pool  so  we  can  easily  observe  relationships  along  the  waterways.  Finally,  we 
associate  each  delivery  date  with  a  week  of  year  (1  through  52).  The  result  is  a  new 
augmented  table  with  the  following  fields: 

•  New  Commodity  Name, 

•  New  Origin  Name, 

•  Origin  ID, 

•  Origin  Pool, 

•  New  Destination  Name, 

•  Destination  ID, 

•  Destination  Pool,  and 

•  Week  Number. 

Table  1  shows  a  partial  list  (Monongahela  River  terminals  only)  of  our  terminal 
names  with  their  identification  numbers.  Because  our  river  network  connects  to  a  much 
larger  network  of  rivers  via  the  Ohio  River,  we  adopt  the  convention  of  a  notional  node 
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outside  of  our  region.  This  single  ‘super’  terminal,  known  as  the  OHIOl,  represents  an 
aggregate  of  all  source  and  destination  terminals  outside  of  our  AOI. 


TERMINAL  NODE 

NODE  ID  # 

OHIOl 

1 

MON  1 

111 

MON  2 

112 

MON3 

113 

MON  4 

114 

MON5 

115 

MON  6 

121 

MON  7 

122 

MON_8 

123 

MON  9 

124 

MONIO 

125 

MON  11 

131 

MON  12 

132 

MON  13 

141 

MON  14 

142 

MON15 

143 

MON16 

151 

MON_17 

152 

MON_18 

161 

MON19 

162 

MON20 

163 

MON  21 

164 

MON  22 

171 

Table  1.  Terminal  nodes  with  node  identification  numbers.  Our  Ohio  Super  terminal 
is  OHIO  l  and  its  node  identification  number  is  1.  The  last  terminal  on  the 
Monongahela  is  MON  22  and  its  node  identification  number  is  171. 


Additional  nodes  enable  the  model  to  properly  replicate  real-world  functionality, 
such  as  an  offloading  point  along  a  river.  These  include  river  nodes,  rail  nodes,  and  road 
nodes.  There  are  many  of  these  nodes  in  our  model;  several  examples  of  these  nodes  are 
listed  in  Table  2. 
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Intennodal  Nodes 

Node  ID  # 

ROADOHIO  1 

342 

ROAD  MON1 

343 

ROAD_MON_2 

344 

RAIL  OHIO  1 

242 

RAIL  MON  1 

243 

RAIL  MON_2 

244 

RIVER  OHIO  1 

139 

RIVER  MON  1 

140 

RIVER  MON  2 

141 

Table  2.  River,  rail,  and  road  nodes  facilitate  intermodal  transfers.  The 
ROAD  OHIO  l  node  is  the  road  node  associated  with  the  OHIO  l 
terminal  and  its  node  identification  number  is  342. 

Arcs  connecting  these  nodes  are  limited  by  capacities  related  to  their  mode  of  transport 
(i.e.,  river,  rail,  or  road)  and  loading  and  offloading  equipment  (cranes,  conveyors)  at 
terminals 


2.  Data  Aggregation 

Observing  coal  throughput  is  a  first  step  in  understanding  key  infrastructure. 
Trying  to  understand  thousands  of  pieces  of  data  independently  is  a  daunting  task,  so  we 
build  an  origin-destination  matrix  to  group  similar  data  and  expose  delivery  patterns.  The 
matrix  in  Figure  12  illustrates  this  aggregation  of  coal  data.  The  row  and  column  headers 
are  our  terminal  nodes,  listed  by  their  identification  numbers.  Lines  in  the  matrix 
represent  locks  and  dams.  Flows  are  grey-scale  coded  to  highlight  supply  and  demand 
fluctuations,  with  light  grey  representing  low,  dark  grey  representing  medium  and  black 
representing  high  tonnage. 
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Figure  12.  Origin-Destination  Matrix  for  coal  transport.  The  sparsity  of  this  matrix  indicates  that  in  practice  there  are  only  a 
relatively  small  number  of  contracted  supplier-customer  relationships. 
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From  this  matrix  we  develop  Table  3  that  shows  a  ranking  of  the  most  significant 
shippers  and  receivers  of  coal  for  an  entire  year.  Clearly,  coal  moving  to  and  from 
OHIO  l  is  significant.  But,  flow  along  the  Monongahela  is  also  very  substantial. 


RANK 

TONS 

RECEIVED 

%  OF  TOTAL 

RANK 

TONS 

SHIPPED 

%  OF  TOTAL 

1 

4,788,373 

OHIO_l 

25.27% 

1 

6,627,767 

MON_15 

34.97% 

2 

4,081,834 

MON  14 

21.54% 

2 

4,356,684 

OHIO  1 

22.99% 

3 

2,694,070 

MON_4 

14.22% 

3 

3,458,572 

MON_13 

18.25% 

4 

1,980,786 

MON_19 

10.45% 

4 

1,704,103 

OHIOJ.7 

8.99% 

5 

1,079,146 

ALLY_1 

5.69% 

5 

1,429,133 

MON_20 

7.54% 

6 

749,909 

MON_l 

3.96% 

6 

358,129 

OHIO_ll 

1.89% 

7 

744,456 

MON_ll 

3.93% 

7 

184,139 

MON_12 

0.97% 

8 

473,327 

MON_2 

2.50% 

8 

181,888 

MON_21 

0.96% 

9 

469,791 

OHIO_14 

2.48% 

9 

153,200 

MON_17 

0.81% 

10 

429,211 

OHIOJ.9 

2.26% 

10 

142,763 

MON_18 

0.75% 

11 

376,478 

MON_9 

1.99% 

11 

114,821 

MON_10 

0.61% 

12 

356,279 

MON_12 

1.88% 

12 

101,198 

MON  6 

0.53% 

13 

236,322 

OHIO_16 

1.25% 

13 

61,871 

OHIOJ.8 

0.33% 

14 

216,920 

OHIO_5 

1.14% 

14 

35,529 

ALLY_3 

0.19% 

15 

95,186 

OHIO  15 

0.50% 

15 

19,585 

MON  5 

0.10% 

16 

49,062 

MON_7 

0.26% 

16 

11,755 

MON_8 

0.06% 

17 

42,805 

MON_23 

0.23% 

17 

8,083 

MON_23 

0.04% 

18 

39,914 

OHIO_8 

0.21% 

18 

1,570 

MON 3 

0.01% 

19 

34,015 

MON_6 

0.18% 

20 

10,038 

OHIO_3 

0.05% 

21 

1,768 

ALLY_3 

0.01% 

22 

1,100 

OHIOJL7 

0.01% 

Table  3.  Top  receiving  and  shipping  terminals  in  the  entire  Port  of  Pittsburgh.  The 
OFIIOl  terminal  is  essentially  an  exit  portal  from  our  AOI.  Note  the  large 
amounts  of  coal  entering  and  leaving  the  system  at  this  terminal. 


Figure  13  illustrates  how  seasonal  climate  changes  affect  coal  demand  in  the 
Pittsburgh  region.  Cold  winter  months  (December,  January,  February,  and  March)  and 
hot  summer  months  (July  and  August)  increase  heating  and  cooling  needs.  The  lowest 
consumption  occurs  in  October  (~7.6  million  tons),  compared  to  the  highest  consumption 
in  February  (—12.6  million  tons).  February  has  shorter  days,  approximately  10.5  hours  of 
sunlight,  meaning  more  electricity  is  used  for  lighting,  compared  to  12  hours  of  sunlight 
in  October.  Colder  February  temperatures,  on  average  35  degrees  Fahrenheit,  result  in 
increased  heating  costs  compared  to  mild  October  temperatures  of  55  degrees  Fahrenheit 
(The  Weather  Channel  2012).  These  seasonal  factors  influence  a  nearly  66%  increase  in 
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coal  consumption.  In  order  to  observe  model  behavior  under  a  more  stressful  coal 
delivery  scenario,  we  consider  normal  operation  during  one  of  these  peak  periods, 
specifically  week  1 . 


Figure  13.  Coal  flows  through  the  Pittsburgh  AOI  by  four-week  “month.”  Seasonal 
fluctuations  are  mostly  consistent  across  pools,  with  the  first  eight  weeks  of 
the  calendar  year  showing  the  largest  overall  flows. 

As  one  would  expect,  locks  and  dams  conveying  large  volumes  of  coal  are  more 
significant  to  the  system  than  those  locks  and  dams  supporting  little  or  no  coal 
movement.  Because  dams  maintain  navigability  along  the  river,  it  is  vital  that  we 
understand  which  dams  support  the  most  coal  traffic.  Figure  14  shows  coal  throughput, 
measured  in  tons,  for  each  pool  in  the  Port  of  Pittsburgh.  It  is  clear  that  pools  40,  50,  60, 
and  110  constitute  a  top-tier.  The  next  significant  group  consists  of  pools  0,  10,  20,  30, 
120,  130,  140  and  possibly  150  and  160.  Finally,  it  seems  that  pools  70,  80,  90,  100,  and 
170  are  less  critical  to  the  movement  of  the  majority  of  coal  through  our  AOI.  This 
cursory  analysis  helps  to  develop  our  intuition  regarding  coal  traffic  and  provides  a 
baseline  understanding  of  standard  coal  operations  in  the  Pittsburgh  region. 
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Coal  Flow  by  Pool 

months  13 

■  months  12 
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■  months  9 

■  months  8 

■  months  7 

■  months  6 

■  months  5 

■  months  4 

■  months  3 

1 i  nnn  nnn 

i  n  nnn  nnn 

s  nnn  nnn 

c  nnn  nnn 

a  nnn  nnn 

i  nnn  nnn 

-  1 

n 

=  =  =  = 

jj 

0  10  20  30  40  50  60  70  80  90  100110120130140150160170 

pools 

■  months  2 

■  months  1 

Figure  14.  Coal  flow  through  each  pool  in  the  Pittsburgh  area.  Pools  0  through  60 
constitute  the  Ohio  River.  Pools  70  through  100  constitute  the  Allegheny 
River.  Pools  110  through  170  constitute  the  Monongahela  River. 


The  bar  chart  in  Figure  14  illustrates  the  disproportionately  small  volume  of  coal 
flowing  through  the  Allegheny  River  (Pools  70,  80,  90,  and  100).  This  chart  also  shows 
the  large  amount  of  coal  flowing  into,  out  of,  and  remaining  on  the  Monongahela  River 
(Pools  110  through  170).  For  these  reasons,  we  focus  our  attention  on  the  Monongahela 
River. 


G.  BUILDING  INPUT  FILES  FOR  GAMS 

Constructing  usable  input  files  for  GAMS  requires  the  thoughtful  collection  and 
aggregation  of  various  data  fields.  Figure  15  displays  a  portion  of  the  arc_data.csv  file, 
which  lists  all  arcs  by  mode,  source,  and  destination.  The  data  file  also  includes  directed 
and  undirected  capacities  ( cap  and  u cap),  cost  per  ton-mile  to  traverse  the  arc  (cost),  a 
penalty  value  for  attempting  to  traverse  the  arc  if  the  arc  is  attacked  ( q ),  and  a  repair  time 
(recon  time)  for  each  arc.  This  file  is  an  example  of  the  types  of  files  necessary  for 
system  interdiction  modeling  with  GAMS.  Such  files  consist  of  thousands  of  lines  of 
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information,  which  are  impractical  to  manually  generate.  The  use  of  explicit  rules  and 
programming  logic  applied  via  VBA  coding  enables  quick,  accurate  computation  and 
provides  flexibility  for  later  changes. 


A 

B 

C 

D 

E 

F 

G 

H 

1 

mode 

source 

destination 

cap 

cost 

q 

ucap 

recon_time 

2 

RAIL 

RAIL  MON  3 

RAIL  MON  BRIDGE  1 

28500000 

1.35 

10000 

28500000 

1 

3 

RAIL 

RAIL  MON  3 

RAIL  MON  BRIDGE  2 

28500000 

1.32 

10000 

28500000 

1 

4 

RAIL 

RAIL  MON  3 

RAIL  MON  BRIDGE  3 

28500000 

1.34 

10000 

28500000 

1 

5 

RAIL 

RAIL  MON  3 

RAIL  MON  BRIDGE  4 

28500000 

1.41 

10000 

28500000 

1 

6 

ROAD 

ROAD  MON  3 

ROAD  MON  2 

1750000 

0.78 

10000 

1750000 

1 

7 

ROAD 

ROAD  MON  3 

ROAD  MON  4 

1750000 

0.87 

10000 

1750000 

1 

8 

ROAD 

ROAD  MON  3 

ROAD  MON  5 

1750000 

0.74 

10000 

1750000 

1 

9 

ROAD 

ROAD  MON  3 

ROAD_MON_6 

1750000 

0.65 

10000 

1750000 

1 

10 

ROAD 

ROAD  MON  3 

ROAD  MON  7 

1750000 

0.71 

10000 

1750000 

1 

11 

RIVER 

RIVER_MON_3 

POOL_120_IN 

30200000 

0.005 

10000 

30200000 

2 

Figure  15.  The  arc_data.csv  file  showcases  various  fields  necessary  for  system 
interdiction  modeling.  Generating  such  files  manually  is  impractical.  The 
RAIL  arc  originating  from  RAILMON3  and  destined  for 
RAIL  MON  BRIDGE  l  has  a  directed  capacity  (cap)  and  undirected 
capacity  ( ucap )  of  28,500,000,  a  transportation  cost  of  $1.35  per  ton-mile, 
an  interdiction  penalty  (q)  of  10,000  and  a  repair  time  (recon  time)  of  1 
week. 


Time  developing  data  is  time  well  spent,  even  if  the  upfront  cost  to  evaluate  raw 
data  may  seem  high.  Our  raw  data  contains  over  20,000  lines  of  information  with  over  25 
unique  fields.  However,  the  reward  for  properly  assessing  the  data  and  digesting  the  story 
the  numbers  tell  is  worth  the  investment.  This  initial  analysis  enables  quick 
understanding  of  coal  movement  through  the  AOI,  gives  us  some  cursory  intuition 
regarding  the  more  significant  and  less  significant  infrastructure  components,  and 
provides  useful  input  for  GAMS  to  quickly  solve  large,  complex  problems. 

H.  ASSESSING  BASELINE  OPERATIONS:  THE  MONONGAHELA  RIVER 

In  the  remainder  of  this  thesis,  we  focus  on  the  flow  of  coal  on  the  Monongahela 
River.  Although  only  a  subset  of  our  entire  AOI,  it  is  a  region  with  perhaps  the  highest 
density  of  river  terminals.  Figure  16(Left)  identifies  this  narrowed  AOI. 
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Figure  16.  Left:  The  Monongahela  River  highlighted  in  blue  within  the  oval.  Right: 

Network  representation  of  the  Monongahela  River. 

To  further  make  the  case  for  the  significance  of  focusing  on  the  Monongahela 
River,  the  largest  coking  plant  in  the  U.S.,  the  U.S.  Steel  Clairton  Plant,  and  the  largest 
underground  coal  mine  in  the  U.S.  both  reside  on  this  river  (Waterways  Council  2010). 
Additionally,  the  river  has  24  terminals,  eight  pools,  seven  locks  and  dams,  eight  rail 
bridges,  and  26  road  bridges.  Although  reduced  in  size,  this  system  has  significant 
“internal”  coal  flow  (i.e.,  shipments  originating  from  a  terminal  on  the  Monongahela 
River  and  destined  for  delivery  to  another  terminal  on  the  Monongahela  River),  as  well  as 
significant  inbound  and  outbound  coal  shipments  (i.e.,  coming  to  or  from  terminals  on  the 
Ohio  River).  Figure  16(Right)  illustrates  our  narrowed  focus  of  the  Monongahela  River 
network. 

Having  developed  the  necessary  input  data  for  the  Operator’s  Model,  we  begin 
with  an  analysis  of  uninterrupted  operations.  Considering  only  one  week  of  operations, 
our  model  estimates  1,244,879  tons  of  coal  is  delivered  at  a  cost  of  $255,450.  All  coal  is 
transported  along  the  river  and  transfer  costs  account  for  approximately  one-third  of  total 
cost.  This  requires  a  minimum  of  7 1 1  fully  loaded  barges. 
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These  operating  costs  serve  as  a  baseline  for  all  subsequent  analysis.  With  no 
interdictions  the  Operator’s  Model  finds  the  least  costly  method  of  transporting  all 
shipments  of  coal  from  source  to  destination.  In  this  case,  the  mode  of  RIVER  is  chosen 
for  its  low  cost  per  ton-mile  rate.  This  is  consistent  with  the  real  system,  in  which  all 
commodities  move  by  barge. 

In  reality,  contracts  between  suppliers  (e.g.,  mines)  and  consumers  (e.g., 
electricity  plants)  drive  flows  from  sources  to  destinations.  Table  4  displays  contract  data 
for  the  first  week  of  operation  on  the  Monongahela  River.  Keep  in  mind  that  Ohio  super 
terminal  OHIOl  represents  source  and  destination  activity  outside  of  our  narrowed  AOI, 
which  only  includes  the  Monongahela  River. 


CONTRACTS 

SOURCE 

DESTINATION 

CARGO  TYPE 

WEEK 

AMOUNT 

OHIO_l 

OHIO_l 

COAL_A 

1 

6957 

OHIO_l 

MON_6 

COAL_A 

1 

3097 

OHIO_l 

MON_4 

COAL_A 

1 

22165 

OHIO_l 

MON_ll 

COAL_A 

1 

2236 

OHIO_l 

MON_14 

COAL_A 

1 

9775 

OHIO_l 

MON_19 

COAL_A 

1 

9802 

MON_5 

OHIO_l 

COAL_A 

1 

1431 

MON_8 

MON_9 

COAL_A 

1 

988 

MON_12 

MON_9 

COAL_A 

1 

1171 

MON_13 

OHIO_l 

COAL_A 

1 

14780 

MON_13 

MON_14 

COAL_A 

1 

2131 

MON_13 

MON_19 

COAL_A 

1 

2088 

MON_15 

OHIO_l 

COAL_A 

1 

59788 

MON_15 

MON_14 

COAL_A 

1 

15059 

MON_20 

MON_9 

COAL_A 

1 

2952 

MON_20 

MON_14 

COAL_A 

1 

5003 

MON_20 

MON_19 

COAL_A 

1 

7609 

Table  4.  Week  1  contracts  between  mines  and  plants.  The  contract  between 
MON15  and  OHIO  l  is  for  cargo  type  COAL  A,  in  week  1,  for  59,788 
tons. 

To  explain  in  more  detail  the  commodity  flows  in  our  model,  we  will  focus  on  the 

59,788  tons  of  COAL_A  transported  from  MON_15  (Node  ID  #143)  to  OHIO_l  (Node 

ID  #1).  The  cartoon  depiction  in  Figure  17  demonstrates  movement  of  coal  from  the 

MON15  source  node  to  the  OHIO  l  destination  node.  The  coal  passes  through  several 
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locks  and  dams;  as  the  total  tonnage  is  far  less  than  the  maximum  capacity  for  a  lock 
during  a  one -week  period.  Also,  note  the  transfers  from  MON15  onto  the  river  and 
ultimately  off  the  river  to  OHIOl.  The  total  cost  for  the  delivery  of  this  coal  is  $27,383, 
which  is  a  function  of  distance,  mode  of  travel  rate  (recall,  river  =  $0,008  per  ton  mile, 
rail  =  $0.05  per  ton  mile,  road  =  $0.10  per  ton  mile),  total  tonnage,  plus  loading  and 
offloading  costs  (loading  =  $0.15  per  ton  and  offloading  =  $0.30  per  ton). 


© 
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Figure  17.  The  flow  of  coal  satisfying  the  contract  from  the  MON15  mine  at  terminal 
node  #143  to  the  OHIO  l  plant  at  tenninal  node  #1. 
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V.  ATTACK  AND  DEFENSE  OF  RIVER  OPERATIONS 


Attacks  to  river  infrastructure  in  the  Port  of  Pittsburgh  pose  considerable  threat.  In 
a  single  week,  the  Monongahela  River  moves  more  than  one  million  tons  of  coal  at  a  cost 
of  more  than  $250,000.  In  this  chapter,  we  identify  interdictions  that  result  in  worst-case 
disruptions,  where  “worst-case”  means  the  highest  total  cost  even  after  the  system  has 
rebalanced  flows. 

We  use  our  Operator’s  Model  as  a  starting  point.  In  the  event  of  an  attack,  the 
Operator’s  Model  will  reroute  cargo,  finding  the  cheapest  means  to  satisfy  demand  in  a 
disrupted  environment.  Undisrupted,  the  system  loads  cargo  on  the  river,  the  cargo 
travels  to  its  destination,  and  the  cargo  is  offloaded.  A  disruption  to  the  river  unavoidably 
increases  traffic  on  other  modes  of  transport.  Because  river  transport  is  the  cheapest  mode 
of  travel,  moving  cargo  by  rail  or  road  certainly  increases  cost.  This  increase  in  traffic 
may  also  challenge  shipment  capacities  (e.g.,  insufficient  number  of  available  trucks  or 
rail  cars)  or  exceed  transfer  equipment  capacities  (e.g.,  slow  conveyors  or  small  cranes); 
further  increasing  costs  if  demand  is  frustrated. 

In  our  analysis,  we  first  consider  the  effects  of  a  single  attack:  analyzing  the 
attacker’s  most  impactful  single-attack  locations  and  ranking  them  accordingly.  Then  we 
consider  multiple  simultaneous  attacks,  where  the  attacker  chooses  the  most  impactful 
locations  to  for  two,  three,  four,  and  five  simultaneous  attacks.  We  compare  these 
outcomes  in  an  operator’s  “resiliency  curve.”  Finally,  we  consider  attacks  under  varying 
conditions:  first,  perfectly  protected  dams  and,  then,  perfectly  protected  locks  and  dams. 
These  two  alternative  scenarios  provide  insight  on  where  and/or  how  best  to  employ 
limited  resources  to  improve  system  resiliency  to  disruption. 
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A.  ATTACKER’S  MODEL 

The  Attacker’s  Model  follows  directly  from  the  Operator’s  Model  formulation,  by 
replacing  the  input  data  ATTACK my  with  a  decision  variable  X,m/. 


Additional  Data 

num  attacks  Number  of  allowable  attacks 

Additional  Variables 

Xmij  Disrupt  Flow  on  arc  (m,i,j), 

binary  indicator  as  to  whether  arc  ( m,i,j )  e  A  is  damaged; 
=  1  if  arc  (m,i,j)  is  damaged, 

=  0  otherwise 

Formulation  2:  Attacker-Defender  Model  (AD) 
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The  objective  function  (AO)  replaces  (SO)  and  now  takes  a  bi-level  max-min  form, 
with  decision  variables  Xmij  replacing  data  ATTACK mij .  Operating  constraints  (S1)-(S5) 
apply  as  before.  Constraints  (A6)  make  sure  that  any  attack  on  a  directed  arc  also  affects 
its  symmetric  arc.  Constraints  (A7)  enforce  the  attacker’s  “budget.”  Constraints  (A8) 
enforce  the  binary  nature  of  attacks. 

We  implement  the  Attacker’s  Model  using  the  General  Algebraic  Modeling 
System  (GAMS  2012),  and  solve  it  with  Bender’s  Decomposition  (see  Wood.  2011.  for 
details  on  the  use  of  this  technique  to  solve  bi-level  network  interdiction  problems)  using 
the  CPLEX  Optimization  Solver  (ILOG  2012). 
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B.  WORST-CASE  SINGLE  ATTACK 

We  immediately  see  a  248  percent  increase  in  operating  costs,  at  $559,204.  Coal 
is  now  primarily  delivered  via  rail  and  transfer  costs  have  increased  nearly  40  percent,  to 
$100,513. 

The  worst  single  attack  is  on  Pool  60,  essentially  cutting  off  all  river  traffic  into 
and  out  of  the  Monongahela  River.  This  causes  the  operator  to  move  the  majority  of  coal 
by  rail  to  its  destination.  This  disruption  causes  a  decrease  in  river  transport,  as  a  large 
amount  of  cargo  is  shipped  from  the  Monongahela  River  to  destinations  outside  of  the 
Monongahela  River  and  a  large  amount  of  cargo  is  shipped  from  origins  outside  of  the 
Monongahela  River  to  destinations  on  it. 

The  top  15  worst-case  single  attacks  are  listed  in  Figure  18.  Baseline  operations 
are  highlighted  in  green  and  the  most  impactful  attacks  are  listed  in  descending  order. 
The  first  four  worst  attacks  are  attacks  on  dams.  These  attacks  make  river  transport 
through  the  associated  pool  impossible,  as  the  loss  of  a  dam  means  the  loss  of  pool  draft 
and  therefore  pool  navigability.  The  next  most  impactful  attack  occurs  at  a  lock,  which 
makes  transfer  between  the  two  associated  pools  impossible. 
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COST  OF  TOP  15  SINGLE  BEST  ATTACK 
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Figure  18. 


Baseline  operating  costs  (green)  and  the  cost  of  the  best  15  single  attacks  to  the  Monongahela  River.  Dams  are  attacked 
first,  restricting  navigation  through  pools.  Locks  are  then  attacked,  restricting  the  ability  to  transit  between  pools. 
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c. 


MULTIPLE  SIMULTANEOUS  ATTACKS 


Simultaneous  disruptions  may  occur  at  multiple,  separate  locations.  These 
simultaneous  attacks  will  necessarily  increase  costs  above  the  cost  of  a  single  worst-case 
disruption.  The  worst-case  scenario  for  two  simultaneous  attacks  occurs  at  Pool  60  and 
Pool  130.  This  attack  causes  total  operating  costs  to  rise  to  $598,421.  The  majority  of 
coal  is  then  shipped  via  rail,  while  some  is  still  moved  via  river.  Interestingly,  transfer 
costs  decrease  from  the  single  attack  scenario,  as  the  operator  chooses  to  ship  directly 
from  source  to  destination  via  rail,  rather  than  transferring  coal  to  the  river,  partly  using 
the  river,  then  transferring  to  rail  for  the  remainder  of  the  trip.  With  two  simultaneous 
attacks,  the  operator  avoids  multiple  loading  and  offloading  transfers.  Table  5  displays 
these  statistics.  We  maintain  this  standard  of  conveying  operating  results  throughout  the 
remainder  of  this  analysis.  As  attacks  increase,  barge  use  decreases,  and  rail  car  and  truck 
use  increase.  Table  5  deconstructs  the  costs  associated  with  each  mode  of  transport, 
beginning  with  zero  attacks  and  ending  with  five  simultaneous  attacks.  Looking  at  the 
MODAL  COST,  it  becomes  apparent  that  transportation  costs  rise  drastically  following 
the  initial  attack(s). 
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# ATTACKS 

MODE 

TONS 

TON-MILES 

MODAL  COST 

TOTAL  COST 

0 

river 

1,244,879 

711  barges 

19,176,963 

$153,416 

$225,449 

rail 

0 

road 

0 

transfer 

320,150 

320,150 

$72,034 

1 

river 

938,331 

536  barges 

4,438,750 

$35,510 

$559,203 

rail 

123,074 

1230  rail  cars 

8,463,616 

$423,181 

road 

0 

transfer 

446,722 

446,722 

$100,513 

2 

river 

213,250 

121  barges 

894,238 

$7,154 

$598,421 

rail 

153,742 

1537  rail  cars 

10,208,468 

$510,423 

road 

0 

transfer 

359,304 

359,304 

$80,843 

3 

river 

8,819 

5  barges 

53,975 

$432 

$602,146 

rail 

166,354 

1663  rail  cars 

10,593,602 

$529,680 

road 

0 

transfer 

320,150 

320,150 

$72,034 

4 

river 

0 

$602,824 

rail 

169,867 

1698  rail  cars 

10,603,398 

$530,170 

road 

2,964 

118  trucks 

6,206 

$621 

transfer 

320,150 

320,150 

$72,034 

5 

river 

0 

$602,824 

rail 

169,867 

1698  rail  cars 

10,603,398 

$530,170 

road 

2,964 

118  trucks 

6,206 

$621 

transfer 

320,150 

320,150 

$72,034 

Table  5.  Most  impactful  simultaneous  attacks:  0  through  5.  For  2  simultaneous 
attacks,  213,250  tons  of  coal  is  transported  via  river  and  153,742  tons  of 
coal  is  transported  via  rail.  The  cost  to  operate  the  system  becomes 
$598,421. 

The  worst-case  scenario  for  three  simultaneous  attacks  occurs  at  Pool  60,  Pool 
130,  and  Pool  150.  These  attacks  cause  total  operating  costs  to  rise  to  $602,145.  The 
majority  of  coal  is  shipped  via  rail,  while  some  is  still  moved  via  river  and  transfer  costs 
continue  to  decrease. 

The  worst-case  scenario  for  four  simultaneous  attacks  occurs  at  Pool  60,  Pool 
110,  Pool  130,  and  Pool  150.  These  attacks  cause  total  operating  costs  to  rise  to 
$602,824.  The  majority  of  coal  is  shipped  via  rail,  while  some  is  still  moved  via  river  and 
transfer  costs  continue  to  decrease.  Finally,  some  coal  is  moved  via  road. 
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The  worst-case  scenario  for  five  simultaneous  attacks  occurs  at  Pool  60,  Pool  110, 
Pool  120,  Pool  130,  and  Pool  150.  These  attacks  cause  total  operating  costs  to  plateau  at 
$602,824. 

The  Operator’s  Resiliency  Curve  in  Figure  19  illustrates  the  increased  costs 
associated  with  attacks  0  through  5.  This  increased  cost  to  operate  the  system  represents 
the  attacker’s  “return  on  investment.”  Each  attack  increases  costs;  however,  after  only 
two  attacks,  the  incremental  costs  become  very  small. 


Figure  19.  Operator’s  Resiliency  Curve.  For  an  increasing  number  of  attacks  on  this 
system,  there  is  a  diminishing  return  to  the  amount  of  incremental  cost  that 
can  be  forced  upon  the  operator. 

Our  analysis  shows  the  results  of  single  attacks  and  multiple  attacks  significantly 
increase  operating  costs.  Additionally,  we  note  attacks  most  often  occur  on  dams,  to 
eliminate  the  use  of  pools,  or  on  locks,  to  restrict  movement  between  pools.  These  attacks 
focus  on  frustrating  the  flow  of  coal  into  and  out  of  our  narrowed  AOI  on  the 
Monongahela  River.  We  also  notice  attacks  toward  the  middle  of  the  Monongahela  River, 
disrupting  the  large  amounts  of  internal  coal  flows. 

Table  6  breaks  out  the  best  attack  locations,  total  cost,  and  cost  increases  from 
baseline  operations  for  attacks  ranging  from  zero  to  five  simultaneous  attacks.  The 
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financial  impact  of  a  2-attack  scenario  rises  to  265  percent  increase  from  baseline 
operations.  However,  all  subsequent  combinations  of  attacks  (3-attacks,  4-attacks,  and  5- 
attacks)  result  in  less  than  2  percent  increase  in  costs. 


1  week 


# ATTACKS 

RANK 

BEST  LOCATION  OF  ATTACK 

COST 

COST  INCREASE 

FROM  BASELINE 

%  COST  INCREASE 

FROM  BASELINE 

0 

0 

BASELINE 

$225,449 

1 

DAM 

POOL_60_IN  POOL_60_OUT 

$559,203 

$333,754 

248.04% 

2 

DAM 

POOLJ.10JN  POOL_HO_OUT 

$388,037 

$162,588 

172.12% 

3 

DAM 

POOL_130_IN  POOL_130_OUT 

$373,038 

$147,589 

165.46% 

4 

DAM 

POOL_120_IN  POOL_120_OUT 

$372,403 

$146,954 

165.18% 

5 

LOCK 

POOL_130_OUT  POOL_120_IN 

$319,173 

$93,724 

141.57% 

6 

LOCK 

POOL_HO_OUT  POOL_60_IN 

$310,903 

$85,454 

137.90% 

7 

LOCK 

POOL_120_OUT  POOL_HO_IN 

$310,451 

$85,002 

137.70% 

1 

8 

DAM 

POOL_140_IN  POOL_140_OUT 

$261,268 

$35,819 

115.89% 

9 

LOCK 

POOL_130_OUT  POOL_140_IN 

$255,921 

$30,472 

113.52% 

10 

LOCK 

POOL_120_OUT  POOL_130_IN 

$250,601 

$25,152 

111.16% 

11 

LOCK 

POOL_HO_OUT  POOL_120_IN 

$249,123 

$23,674 

110.50% 

12 

DAM 

POOL_150_IN  POOL_150_OUT 

$237,558 

$12,109 

105.37% 

13 

LOCK 

POOL_140_OUT  POOL_150_IN 

$233,065 

$7,616 

103.38% 

14 

LOCK 

POOL_150_OUT  POOL_140_IN 

$229,659 

$4,210 

101.87% 

15 

LOCK 

POOL 140 OUT  POOL 130 IN 

$228,686 

$3,237 

101.44% 

1 

DAM 

DAM 

POOL_60_IN  POOL_60_OUT 
POOL_130_IN  POOL_130_OUT 

$598,421 

$372,972 

265.44% 

2 

DAM 

DAM 

POOL_60_IN  POOL_60_OUT 
POOL_120_IN  POOL_12_OUT 

$584,922 

$359,473 

259.45% 

2 

3 

DAM 

LOCK 

POOL_60_IN  POOL_60_OUT 
POOL_130_OUT  POOL_120_IN 

$583,628 

$358,179 

258.87% 

4 

DAM 

DAM 

POOL_60_IN  POOL_60_OUT 
POOL_HO_IN  POOL_HO_OUT 

$580,226 

$354,777 

257.36% 

5 

DAM 

LOCK 

POOL_60_IN  POOL_60_OUT 
POOL 120 OUT  POOL HO IN 

$578,731 

$353,282 

256.70% 

DAM 

POOL_60_IN  POOL_60_OUT 

3 

1 

DAM 

POOL_130_IN  POOL_130_OUT 

$602,145 

$376,696 

267.09% 

DAM 

POOL 150 IN  POOL 150 OUT 

DAM 

POOL_60_IN  POOL_60_OUT 

4 

1 

DAM 

DAM 

POOL_HO_IN  POOL_HO_OUT 
POOL_130_IN  POOL_130_OUT 

$602,824 

$377,375 

267.39% 

DAM 

POOL 150 IN  POOL 150 OUT 

DAM 

POOL_60_IN  POOL_60_OUT 

DAM 

POOL_HO_IN  POOL_HO_OUT 

5 

1 

LOCK 

POOL_120_OUT  POOL_HO_IN 

$602,824 

$377,375 

267.39% 

DAM 

POOL_130_IN  POOL_130_OUT 

DAM 

POOL_150_IN  POOL_150_OUT 

Table  6.  Impact  of  multiple  simultaneous  attacks.  With  5  simultaneous  attacks,  Pools 
60,  110,  130,  and  150  are  attacked,  as  well  as  the  lock  from  Pool  120  to 
110.  This  results  in  an  operating  cost  of  $602,824,  which  is  an  increase 
from  the  baseline  of  267.39%. 
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Interestingly,  the  system  seems  to  be  fairly  resilient  following  just  two  attacks. 
This  results  from  a  robust  rail  network  and  modeling  assumptions  that  make  the  rail 
network  nearly  invulnerable.  It  takes  five  attacks  to  force  coal  onto  the  most  expensive 
form  of  transportation:  trucks  on  roads.  Again,  the  transfer  costs  have  receded  to  pre¬ 
attack  costs,  as  the  model  no  longer  finds  it  advantageous  or  possible  to  conduct  more 
than  one  loading  and  one  offloading  action  per  shipment. 

D.  ALTERNATIVE  SCENARIOS 

To  this  point  our  study  has  considered  single  and  multiple  attacks  on  our  network. 
Now,  we  will  consider  alternative  scenarios  involving  (1)  perfect  protection  of  the  dams 
along  the  river  and  (2)  perfect  protection  of  both  locks  and  dams  along  the  river.  This 
perfect  protection  equates  to  the  invulnerability  of  those  assets  (i.e.,  dams  and  locks). 

The  Operator’s  Resiliency  Curve  (denoted  by  green  triangles)  in  Figure  20 
illustrates  the  decreased  impact  of  attacks  on  our  system  when  pools  are  perfectly 
protected.  Each  set  of  attacks  results  in  a  reduced  return  on  investment  for  the  attacker. 
This  seems  reasonable  because  the  most  damaging  attacks  under  normal  operating 
conditions  are  on  pools. 


Figure  20.  Operator’s  Resiliency  Curve  with  alternative  scenarios  of  (1)  no  defense, 
where  attacks  occur  on  dams  and  locks  (denoted  by  red  squares),  (2)  dams 
defended,  where  attacks  occur  on  locks  (denoted  by  green  triangles),  and  (3) 
dams  and  locks  are  defended,  where  attacks  occur  on  terminals  (denoted  by 
purple  Xs). 
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Next,  we  consider  the  scenario  of  invulnerable  locks  and  dams.  Here  we  consider 
perfectly  protected  locks  and  dams,  where  the  river  is  fully  navigable.  The  best  single 
attack  occurs  on  the  river  transfer  arc  of  a  major  coal  supplier.  This  attack  causes  coal  to 
be  shipped  via  rail,  rather  than  river.  When  the  attacker  makes  two  simultaneous  attacks, 
the  attacks  occur  on  the  river  transfer  arc  and  the  rail  transfer  arc  of  the  same  major  coal 
supplier.  This  causes  all  coal  supplied  by  this  mine  to  be  routed  on  the  most  expensive 
mode  of  transportation:  road.  Finally,  with  three  simultaneous  attacks,  this  major  coal 
supplier  is  completely  cut  off  from  the  network  and  is  unable  to  move  coal  onto  the 
network  without  sending  flow  along  an  attacked  arc.  This  incurs  an  arbitrarily  high  cost, 
depending  on  the  penalty  we  set.  In  practical  terms,  this  action  equates  to  a  cost  to 
reconstitute  the  damaged  arc  to  enable  the  movement  of  coal.  The  Operator’s  Resiliency 
Curve  in  Figure  20  (denoted  by  purple  Xs)  illustrates  this  behavior.  Initially,  the  return  on 
investment  for  the  first  two  attack  sets  is  low  for  the  attacker.  But,  the  third  attack  is 
significantly  harmful. 

E.  DISCUSSION 

The  USCG  mission  emphasizes  the  defense  of  waterway  infrastructure,  so  we 
initially  focus  on  the  attack  and  defense  of  maritime  CI/KR.  Not  surprisingly,  attacks  that 
target  dams  result  in  worst-case  increase  to  operating  cost,  even  after  river  operations 
adjust  flows  to  minimize  transport  costs.  If  the  USCG  could  perfectly  protect  dams,  we 
observe  that,  in  order  to  create  a  worst-case  increase  in  transport  cost,  an  intelligent 
attacker  would  instead  target  locks,  but  the  return  on  investment  for  mounting  attacks  is 
reduced.  Perfect  defense  of  dams  and  locks  shifts  the  attention  of  an  attacker  to  coal 
tenninals.  In  this  case,  attacking  the  ability  to  transfer  coal  on  or  off  the  river  at  an 
individual  terminal  results  in  less  overall  cost  increase,  unless  an  attacker  can  isolate  a 
tenninal  by  interdicting  completely  its  ability  to  send  or  receive  coal.  In  this  case,  the 
resulting  “cost”  of  that  isolation  can  be  arbitrarily  high,  depending  on  the  economic 
consequences  to  that  terminal.  This  study  considers  only  a  simple  cost  of  isolation  that  is 
the  same  for  all  tenninals;  thus  the  tenninals  targeted  are  the  ones  that  move  the  largest 
volumes  of  coal. 
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VII.  CONCLUSION 


The  Port  of  Pittsburgh  is  a  valuable  target.  With  approximately  $9  billion  in 
annual  commerce,  the  second  largest  inland  port  in  the  U.S.  could  be  significantly 
impacted  with  just  a  single  attack,  causing  operating  costs  to  rise  nearly  150  percent. 
Adversaries  are  plotting  to  disrupt  commerce,  as  evidenced  by  the  recent  planned  attack 
on  a  bridge  in  neighboring  Ohio  (Barrett  2012).  The  use  of  system  interdiction  techniques 
allows  us  to  identify  the  most  critical  infrastructure  in  our  system;  in  our  case  dams, 
which  support  pool  navigability.  This  modeling  method  allows  us  to  quantify  impacts  to 
operating  costs  and  consider  various  alternative  scenarios  concerning  defense  tactics  and 
schemes. 

The  analysis  in  this  thesis  represents  an  important  step  forward  in  assessing  the 
resilience  of  the  Port  of  Pittsburgh,  and  the  Inland  Marine  Transportation  System  more 
broadly,  but  there  is  much  more  to  do. 

First,  the  focus  in  this  thesis  on  the  Monongahela  River  should  be  extended  to 
include  the  entire  Three  Rivers.  We  expect  broader  analysis  to  confirm  the  significance  of 
the  Monongahela  River  as  a  critical  segment  of  the  Port  of  Pittsburgh.  We  also  expect  an 
expanded  study  to  expose  valuable  targets  along  the  Ohio  River,  as  this  river  connects 
our  AOI  to  the  larger  Marine  Transportation  System  river  network.  Insights  may  include 
a  clearer  understanding  of  intennodal  transportation  behavior  as  travel  distances  increase. 

Second,  it  will  be  important  to  conduct  analysis  for  horizons  longer  than  a  single 
week.  In  practice,  planning  for  coal  movements  occurs  over  weeks  and  months,  and  the 
repair  times  for  different  system  components  (e.g.,  dams,  locks,  transfer  tenninals,  and 
bridges)  could  yield  different  implications  for  what  is  most  critical.  For  example,  if  dams 
have  the  longest  repair  times,  then  their  loss  naturally  has  a  bigger  impact  on  the  long¬ 
term  system  operation. 

Third,  just  as  different  system  components  can  have  significantly  different  repair 
times,  it  is  reasonable  to  expect  that  attacks  on  these  components  might  require  a 
different  level  of  effort.  Following  the  example  in  Sahneron  et  al.  (2011),  it  might  be 
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reasonable  that  the  attacker’s  “budget”  might  be  measured  in  terms  of  personnel  rather 
than  attacks,  with  each  component  requiring  a  different  number  of  individuals  for  attack 
success. 

Fourth,  because  the  Attacker-Defender  model  has  provisions  to  allow  the  operator 
to  move  coal  in  anticipation  of  an  announced  disruption  to  occur  in  the  future,  it  is 
possible  to  use  this  model  to  assess  the  impact  of  scheduled  maintenance.  Exploring  this 
model  capability  in  the  context  of  real  operations  could  prove  insightful. 

Finally,  the  analysis  in  this  thesis  has  taken  a  limited  view  of  “defensive 
investment,”  but  the  model  and  technique  can  be  extended  to  consider  a  comprehensive 
Defender-Attacker-Defender  formulation  in  which  one  considers  a  list  of  possible 
investment  options,  ranging  from  hardening  to  redundancy  to  capacity  expansion,  each 
with  its  own  cost.  Then  given  a  fixed  limited  investment,  the  DAD  model  will  identify 
the  combination(s)  of  investment  that  yield  the  most  resilient  system.  Moreover,  it  then 
becomes  possible  to  consider  how  different  levels  of  investment  lead  to  improved 
resilience.  Identifying  such  defensive  “return  on  investment”  tradeoffs  will  be  an 
important  avenue  for  future  work,  particularly  in  an  environment  of  diminished  fiscal 
budgets. 
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